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This preface introduces the Cortex-M3 Technical Reference Manual (IRM). It contains the 
following sections: 


° About this book on page x 
° Feedback on page xiii. 
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About this book 


This book is for the Cortex-M3 processor. 


Product revision status 


The rnpn identifier indicates the revision status of the product described in this manual, where: 
rn Identifies the major revision of the product. 
pn Identifies the minor revision or modification status of the product. 


Intended audience 


This manual is written to help system designers, system integrators, verification engineers, and 
software programmers who are implementing a System-on-Chip (SoC) device based on the 
Cortex-M3 processor. 


Using this book 
This book is organized into the following chapters: 


Chapter 1 Introduction 
Read this for a description of the components of the processor, and of the product 
documentation. 

Chapter 2 Functional Description 


Read this for a description of the functionality of the processor. 


Chapter 3 Programmers Model 
Read this for a description of the processor register set, modes of operation, and 
other information for programming the processor. 

Chapter 4 System Control 
Read this for a description of the registers and programmers model for system 
control. 

Chapter 5 Memory Protection Unit 
Read this for a description of the Memory Protection Unit (MPU). 


Chapter 6 Nested Vectored Interrupt Controller 


Read this for a description of the interrupt processing and control. 


Chapter 7 Debug 


Read this for information about debugging and testing the processor core. 
Chapter 8 Data Watchpoint and Trace Unit 
Read this for a description of the Data Watchpoint and Trace (DWT) unit. 


Chapter 9 Instrumentation Trace Macrocell Unit 

Read this for a description of the Instrumentation Trace Macrocell (ITM) unit. 
Chapter 10 Embedded Trace Macrocell 

Read this for a description of the processor Embedded Trace Macrocell (ETM). 


Chapter 11 Trace Port Interface Unit 
Read this for a description of the Trace Port Interface Unit (TPIU). 
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Conventions 


Additional reading 
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Appendix A Revisions 


Read this for a description of the technical changes between released issues of this 
book. 


Glossary Read this for definitions of terms used in this book. 


Conventions that this book can use are described in: 
e Typographical 


Typographical 
The typographical conventions are: 


italic Highlights important notes, introduces special terminology, denotes 
internal cross-references, and citations. 


bold Highlights interface elements, such as menu names. Denotes signal 
names. Also used for terms in descriptive lists, where appropriate. 


monospace Denotes text that you can enter at the keyboard, such as commands, file 
and program names, and source code. 


monospace Denotes a permitted abbreviation for a command or option. You can enter 
the underlined text instead of the full command or option name. 


monospace italic Denotes arguments to monospace text where the argument is to be 
replaced by a specific value. 


monospace Denotes language keywords when used outside example code. 


< and > Enclose replaceable terms for assembler syntax where they appear in code 
or code fragments. For example: 


ADD Rd, Rn, <op2> 


This section lists publications by ARM and by third parties. 


See Infocenter, http://infocenter.arm.com, for access to ARM documentation. 


ARM publications 


This book contains information that is specific to this product. See the following documents for 
other relevant information: 


° ARMv7-M Architecture Reference Manual (ARM DDI 0403) 

e ARM Cortex-M3 Integration and Implementation Manual (ARM DII 0240) 

. ARM AMBA” 3 AHB-Lite Protocol (v1.0) (ARM IHI 0033) 

e ARM AMBA" 3 APB Protocol Specification (ARM IHI 0024) 

e AMBA 3 ATB Protocol Specification (ARM IHI 0032) 

e ARM CoreSight™ Components Technical Reference Manual (ARM DDI 0314) 
e ARM Debug Interface v5 Architecture Specification (ARM IHI 0031) 

. ARM Embedded Trace Macrocell Architecture Specification (ARM IHI 0014). 
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Other publications 


This section lists relevant documents published by third parties: 
° IEEE Standard Test Access Port and Boundary-Scan Architecture 1149.1-2001 (JTAG). 
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Feedback 


ARM welcomes feedback on this product and 1ts documentation. 


Feedback on this product 


If you have any comments or suggestions about this product, contact your supplier and give: 


e The product name. 
e The product revision or version. 
e An explanation with as much information as you can provide. Include symptoms and 


diagnostic procedures if appropriate. 


Feedback on this manual 


If you have comments on content then send e-mail to errata@arm. com. Give: 


. the title 

e the number, doc_number-draft indicator 

e the page number(s) to which your comments refer 
e a concise explanation of your comments. 


ARM also welcomes general suggestions for additions and improvements. 
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Chapter 1 
Introduction 


This chapter introduces the processor and instruction set. It contains the following sections: 


° About the processor on page 1-2 
. Features on page 1-3 
e Interfaces on page 1-4 
e Configurable options on page 1-5 
e Product documentation on page 1-6 
e Product revisions on page 1-9. 
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Introduction 


1.1 About the processor 


The Cortex-M3 is a low-power processor that features low gate count, low interrupt latency, and 
low-cost debug. It is intended for deeply embedded applications that require FIQ interrupt 
response features. 


ARM DDI 0337H Copyright © 2005-2008, 2010 ARM Limited. All rights reserved. 1-2 
IDO32710 Non-Confidential 
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The Cortex-M3 processor incorporates: 
e a processor core 


. a Nested Vectored Interrupt Controller (NVIC) closely integrated with the processor core 
to achieve low latency interrupt processing 


e multiple high-performance bus interfaces 


. a low-cost debug solution with the optional ability to: 
— implement breakpoints and code patches 
— implement watchpoints, tracing, and system profiling 
— support printf style debugging 
— bridge to a Trace Port Analyzer (TPA). 


e an optional Memory Protection Unit (MPU) 


e an optional ETM that enables reconstruction of program execution. 
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The processor has the following external interfaces: 


multiple memory and device bus interfaces 

ETM interface 

trace port interface 

debug port interface 

if the implementation includes an ETM, a Cross Trigger Interface (CTI). 
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1-4 


Introduction 


1.4 Configurable options 
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You can configure your Cortex-M3 implementation to include the following optional 
components: 





MPU. See Chapter 5 Memory Protection Unit. 

Flash Patch and Breakpoint Unit (FPB). See Chapter 7 Debug. 

DWT. See Chapter 8 Data Watchpoint and Trace Unit. 

ITM. See Chapter 9 Instrumentation Trace Macrocell Unit. 

ETM. See Chapter 10 Embedded Trace Macrocell. 

Advanced High-performance Bus Access Port (AHB-AP). See Chapter 7 Debug. 

AHB Trace Macrocell (HTM) interface. See AHB Trace Macrocell interface on page 2-5. 
TPIU. See Chapter 11 Trace Port Interface Unit. 

Wake-up Interrupt Controller (WIC). See Low power modes on page 6-3. 

Debug Port. See Debug port AHB-AP interface on page 2-5. 


Note 


You can only configure trace functionality in the following combinations: 


no trace functionality 

ITM and DWT 

ITM, DWT, and ETM 

ITM, DWT, ETM, and HTM. 


You can configure the debug features provided in the DWT independently. 
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1.5 Product documentation 


1.5.1 Documentation 
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This section describes the processor books, how they relate to the design flow, and the relevant 
architectural standards and protocols. 


See Additional reading on page xi for more information about the books described in this 
section. 


The Cortex-M3 documentation is as follows: 


Technical Reference Manual 


The Technical Reference Manual (TRM) describes the functionality and the 
effects of functional options on the behavior of the Cortex-M3. It is required at all 
stages of the design flow. Some behavior described in the TRM might not be 
relevant because of the way that the Cortex-M3 is implemented and integrated. If 
you are programming the Cortex-M3 then contact: 


e the implementor to determine: 
— the build configuration of the implementation 


— what integration, if any, was performed before implementing the 
processor. 


. the integrator to determine the pin configuration of the SoC that you are 
using. 
Integration and Implementation Manual 
The Integration and Implementation Manual (IIM) describes: 


e The available build configuration options and related issues in selecting 
them. 


. How to configure the Register Transfer Level (RTL) with the build 
configuration options 


e How to integrate the processor into a SoC. This includes a description of 
the integration kit and describes the pins that the integrator must tie off to 
configure the macrocell for the required integration. 


e How to implement the processor into your design. This includes 
floorplanning guidelines, Design for Test (DFT) information, and how to 
perform netlist dynamic verification on the processor. 


e The processes to sign off the integration and implementation of the design. 


The ARM product deliverables include reference scripts and information about 
using them to implement your design. 


Reference methodology documentation from your EDA tools vendor 
complements the ITM. 


The IIM is a confidential book that is only available to licensees. 


Cortex-M3 User Guide Reference Material 


This document provides reference material that ARM partners can configure and 
include in a User Guide for an ARM Cortex-M3 processor. Typically: 


e each chapter in this reference material might correspond to a section in the 
User Guide 
e each top-level section in this reference material might correspond to a 


chapter in the User Guide. 
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Introduction 


However, ARM partners can organize this material in any way, subject to the 
conditions of the licence agreement under which ARM supplied the material. 


The processor is delivered as synthesizable RTL. Before it can be used in a product, it must go 
through the following process: 


Implementation 
The implementor configures and synthesizes the RTL to produce a hard 


macrocell. This might include integrating RAMs into the design. 


Integration The integrator connects the implemented design into a SoC. This includes 
connecting it to a memory system and peripherals. 


Programming 


The system programmer develops the software required to configure and 
initialize the processor, and tests the required application software. 


Each stage in the process can be performed by a different party. Implementation and integration 
choices affect the behavior and features of the processor. 


For MCUs, often a single design team integrates the processor before synthesizing the complete 
design. Alternatively, the team can synthesise the processor on its own or partially integrated, 
to produce a macrocell that is then integrated, possibly by a separate team. 


The operation of the final device depends on: 


Build configuration 


The implementor chooses the options that affect how the RTL source files are 
pre-processed. These options usually include or exclude logic that affects one or 
more of the area, maximum frequency, and features of the resulting macrocell. 


Configuration inputs 


The integrator configures some features of the processor by tying inputs to 
specific values. These configurations affect the start-up behavior before any 
software configuration is made. They can also limit the options available to the 
software. 


Software configuration 


The programmer configures the processor by programming particular values into 
registers. This affects the behavior of the processor. 


Note 


This manual refers to implementation-defined features that are applicable to build configuration 
options. Reference to a feature that is included means that the appropriate build and pin 
configuration options are selected. Reference to an enabled feature means one that has also been 
configured by software. 





1.5.3 Architecture and protocol information 
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The processor complies with, or implements, the specifications described in: 
e ARM architecture on page 1-8 

e Bus architecture on page 1-8 

. Debug on page 1-8 
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° Embedded Trace Macrocell. 


This book complements architecture reference manuals, architecture specifications, protocol 
specifications, and relevant external standards. It does not duplicate information from these 
sources. 


ARM architecture 


The processor implements the ARMv7-M architecture profile. See the ARMv7-M Architecture 
Reference Manual. 


For more information about architectural compliance, see Architecture and protocol 
information on page 1-9. 


Bus architecture 


The processor provides three primary bus interfaces implementing a variant of the AMBA 3 
AHB-Lite protocol. The processor implements an interface for CoreSight and other debug 
components using the AMBA 3 APB protocol. See 


e the ARM AMBA 3 AHB-Lite Protocol (v1.0) 
° the ARM AMBA 3 APB Protocol Specification. 


Debug 


The debug features of the processor implement the ARM debug interface architecture. See the 
ARM Debug Interface v5 Architecture Specification. The processor also implements debug 
features defined by the ARMv7-M. See the ARMv7-M Architecture Reference Manual. 


Embedded Trace Macrocell 


The trace features of the processor implement version 3.4 of the ARM Embedded Trace 
Macrocell architecture. See the ARM Embedded Trace Macrocell Architecture Specification. 
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1.6 Product revisions 


This section summarizes the differences in functionality between the different releases of this 
processor: 


Differences in functionality between r0p0 and rlp0 
Differences in functionality between rlp0 and rlpl 
Differences in functionality between rlp1 and r2p0 on page 1-10. 


1.6.1 Differences in functionality between r0p0 and r1p0 


In summary, the differences in functionality include: 


Addition of configurable data value comparison to the DWT module. 
Addition of a MATCHED bit to DWT_FUNCTION. 


Addition of configurable ETMFIFOFULL stalling functionality to the processor and the 
ETM. 


Addition of SWV Mode to the ITM. 
CPUID Base Register VARIANT field changed to indicate Rev1. 


Cortex-M3 Rev0 Bit-band accesses in BE8 mode required access sizes to be byte. 
Cortex-M3 Rev1 has been changed so that BES bit-band accesses function with any 
access size. 


Addition of a configuration bit called STKALIGN to ensure that all exceptions have 
eight-byte stack alignment. 


Addition of the Auxiliary Fault Status Register at address 0xE000ED3C. To set this register, 
a 32-bit input bus called AUXFAULT has been added. 


Addition of HTM support. 


ICode and DCode cacheable and bufferable HPROT values permanently tied to 
write-through. 


Addition of the SWJ-DP. This is the standard CoreSight™ debug port that combines 
JTAG-DP and SW-DP. 


Addition of DWT_PCSR Register at address 0xE000101C. 


Errata fixes to the r0p0 release. 


1.6.2 Differences in functionality between r1p0 and r1p1 
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In summary, the differences in functionality include: 


Data value matching for watchpoint generation has been made implementation time 
configurable. 


Architectural clock gating in the ETM is configurable at implementation. 


DAPCLKEN was required to be a static signal in r0p0 and rlp0. This requirement has 
been removed for r1pl. 


SLEEPING signal now suppressed until current outstanding instruction fetch has 
completed. 


Errata fixes to the rlp0 release. 
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1.6.3 Differences in functionality between r1p1 and r2p0 
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In summary, the differences in functionality include: 


Implementation time options have been added to select between different levels of debug 
and trace support. This has replaced the previous TIEOFF FPBEN and 
TIEOFF_ TRCENA options. 


New implementation option to enable the resetting of all registers within the processor. 
Architectural clock gating inclusion is now controlled using one implementation option. 


DBGRESTART input and DBGRESTARTED output have been added for use in 
debugging multi-core systems. See the ARMv7-M Architecture Reference Manual for 
more information. 


SLEEPHOLDREOHn input and SEEEPHOLDACKn have been added to enable the 
extension of SLEEPING. 


The APB interface has been upgraded from v2.0 to v3.0. 


A new output signal called INTERNALSTATE has been added that enables observation 
of some of the internal state of the core if the OBSERVATION implementation option is 
used. 


Added support for fault-robust implementations. 


An Auxiliary Control Register has been added with new functionality disable bits to: 
— stop interruption of load/store multiples, divides and multiplies 

— stop IT folding 

— disable the write buffers in Cortex-M3 for default memory map accesses. 

The STKALIGN bit reset value in the Configuration and Control Register at address 


0xE000ED14 has been inverted. The reset value is now 1, which means that the stack frame 
is 8-byte aligned by default. 


Addition of a Wake-up Interrupt Controller to minimize logic in the always clocked 
domain during sleep. 


Addition of FIXHMASTERTYPE pin to prevent debugger marking AHB transactions 
as core data side if required. 


Errata fixes to the rlp1 release. 
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This chapter introduces the processor and its external interfaces. It contains the following sections: 
e About the functions on page 2-2 
e Interfaces on page 2-4. 
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2.1 About the functions 


Figure 2-1 shows the structure of the Cortex-M3 processor. 
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Figure 2-1 Cortex-M3 block diagram 
The Cortex-M3 processor features: 


e A low gate count processor core, with low latency interrupt processing that has: 


— A subset of the Thumb instruction set, defined in the ARMv7-M Architecture 
Reference Manual. 


—  Banked Stack Pointer (SP). 

— Hardware divide instructions, SDIV and UDIV. 
— Handler and Thread modes. 

— Thumb and Debug states. 


— Support for interruptible-continued instructions LDM, STM, PUSH, and POP for low 
interrupt latency. 


— Automatic processor state saving and restoration for low latency Interrupt Service 
Routine (ISR) entry and exit. 


— Support for ARMv6 big-endian byte-invariant or little-endian accesses. 


— Support for ARMv6 unaligned accesses. 
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Functional Description 


Nested Vectored Interrupt Controller (NVIC) closely integrated with the processor core 
to achieve low latency interrupt processing. Features include: 


External interrupts, configurable from 1 to 240. 
Bits of priority, configurable from 3 to 8. 
Dynamic reprioritization of interrupts. 


Priority grouping. This enables selection of preempting interrupt levels and non 
preempting interrupt levels. 


Support for tail-chaining and late arrival of interrupts. This enables back-to-back 
interrupt processing without the overhead of state saving and restoration between 
interrupts. 


Processor state automatically saved on interrupt entry, and restored on interrupt exit, 
with no instruction overhead. 


Optional Wake-up Interrupt Controller (WIC), providing ultra-low power sleep 
mode support. 


Memory Protection Unit (MPU). An optional MPU for memory protection, including: 


Eight memory regions. 
Sub Region Disable (SRD), enabling efficient use of memory regions. 


The ability to enable a background region that implements the default memory map 
attributes. 


Bus interfaces: 


Three Advanced High-performance Bus-Lite (AHB-Lite) interfaces: ICode, 
DCode, and System bus interfaces. 


Private Peripheral Bus (PPB) based on Advanced Peripheral Bus (APB) interface. 
Bit-band support that includes atomic bit-band write and read operations. 

Memory access alignment. 

Write buffer for buffering of write data. 


Exclusive access transfers for multiprocessor systems. 


Low-cost debug solution that features: 


Debug access to all memory and registers in the system, including access to 
memory mapped devices, access to internal core registers when the core 1s halted, 
and access to debug control registers even while SYSRESETn is asserted. 


Serial Wire Debug Port (SW-DP) or Serial Wire JTAG Debug Port (SWJ-DP) debug 
access, or both. 


Optional Flash Patch and Breakpoint (FPB) unit for implementing breakpoints and 
code patches. 


Optional Data Watchpoint and Trace (DWT) unit for implementing watchpoints, 
data tracing, and system profiling. 


Optional Instrumentation Trace Macrocell (ITM) for support of printf style 
debugging. 

Optional Trace Port Interface Unit (TPIU) for bridging to a Trace Port Analyzer 
(TPA), including Single Wire Output (SWO) mode. 


Optional Embedded Trace Macrocell (ETM) for instruction trace. 
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2.2 Interfaces 


2.2.1 Bus interfaces 
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Functional Description 


The processor contains the following external interfaces: 
e bus interfaces 

e ETM interface on page 2-5 

e AHB Trace Macrocell interface on page 2-5 

e Debug port AHB-AP interface on page 2-5. 


The processor contains four external Advanced High-performance Bus (AHB)-Lite bus 
interfaces: 


¡Code memory interface 


Instruction fetches from Code memory space, 0x00000000 to Ox1FFFFFFF, are performed over this 
32-bit AHB-Lite bus. 


The Debugger cannot access this interface. All fetches are word-wide. The number of 
instructions fetched per word depends on the code running and the alignment of the code in 
memory. 


DCode memory interface 


Data and debug accesses to Code memory space, 0x00000000 to Ox1FFFFFFF, are performed over 
this 32-bit AHB-Lite bus. Core data accesses have a higher priority than debug accesses on this 
bus. This means that debug accesses are waited until core accesses have completed when there 
are simultaneous core and debug access to this bus. 


Control logic in this interface converts unaligned data and debug accesses into two or three 
aligned accesses, depending on the size and alignment of the unaligned access. This stalls any 
subsequent data or debug access until the unaligned access has completed. 





Note 


ARM strongly recommends that any external arbitration between the [Code and DCode AHB 
bus interfaces ensures that DCode has a higher priority than ICode. 


System interface 


Instruction fetches, and data and debug accesses, to address ranges 0x20000000 to OxDFFFFFFF and 
0xE0100000 to OxFFFFFFFF are performed over this 32-bit AHB-Lite bus. 


For simultaneous accesses to this bus, the arbitration order in decreasing priority is: 


° data accesses 
. instruction and vector fetches 
e debug. 


The system bus interface contains control logic to handle unaligned accesses, FPB remapped 
accesses, bit-band accesses, and pipelined instruction fetches. 


Private Peripheral Bus (PPB) 


Data and debug accesses to external PPB space, 0xE0040000 to @xEQOFFFFF, are performed over 
this 32-bit Advanced Peripheral Bus (APB) bus. The Trace Port Interface Unit (TPIU) and 
vendor specific peripherals are on this bus. 
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Core data accesses have higher priority than debug accesses, so debug accesses are waited until 
core accesses have completed when there are simultaneous core and debug access to this bus. 
Only the address bits necessary to decode the External PPB space are supported on this 
interface. 


2.2.2 ETM interface 


The ETM interface enables simple connection of an ETM to the processor. It provides a channel 
for instruction trace to the ETM. See the ARM Embedded Trace Macrocell Architecture 
Specification. 


2.2.3 AHB Trace Macrocell interface 


The AHB Trace Macrocell (HTM) interface enables a simple connection of the AHB trace 
macrocell to the processor. It provides a channel for the data trace to the HTM. 


Your implementation must include this interface to use the HTM interface. You must set 
TRCENA to 1 in the Debug Exception and Monitor Control Register (DEMCR) before you 
enable the HTM to enable the HTM port to supply trace data. See the ARMv7-M Architecture 
Reference Manual. 


2.2.4 Debug port AHB-AP interface 


The processor contains an Advanced High-performance Bus Access Port (AHB-AP) interface 
for debug accesses. An external Debug Port (DP) component accesses this interface. The 
Cortex-M3 system supports three possible DP implementations: 


e The Serial Wire JTAG Debug Port (SWJ-DP). The SWJ-DP is a standard CoreSight debug 
port that combines JTAG-DP and Serial Wire Debug Port (SW-DP). 


e The SW-DP. This provides a two-pin interface to the AHB-AP port. 


e No DP present. If no debug functionality is present within the processor, a DP is not 
required. 


The two DP implementations provide different mechanisms for debug access to the processor. 
Your implementation must contain only one of these components. 





Note 


Your implementation might contain an alternative implementor-specific DP instead of SW-DP 
or SWJ-DP. See your implementor for details. 


For more detailed information on the DP components, see the CoreSight Components Technical 
Reference manual. 


For more information on the AHB-AP, see Chapter 7 Debug. 
The DP and AP together are referred to as the Debug Access Port (DAP). 


For more detailed information on the debug interface, see the ARM Debug Interface v5 
Architecture Specification. 
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This chapter describes the processor programmers model. It contains the following sections: 


About the programmers model on page 3-2 
Modes of operation and execution on page 3-3 
Instruction set summary on page 3-4 

System address map on page 3-11 

Write buffer on page 3-14 

Bit-banding on page 3-16 

Processor core register summary on page 3-18 
Exceptions on page 3-20. 
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Programmers Model 


3.1 About the programmers model 
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The ARMv7-M Architecture Reference Manual provides a complete description of the 
programmers model. This chapter gives an overview of the Cortex-M3 processor programmers 
model that describes the implementation-defined options. It also contains the ARMv7-M 
Thumb instructions it uses and their cycle counts for the processor. In addition: 


Chapter 4 summarizes the system control features of the programmers model 
Chapter 5 summarizes the MPU features of the programmers model 

Chapter 6 summarizes the NVIC features of the programmers model 
Chapter 7 summarizes the Debug features of the programmers model 
Chapter 8 summarizes the DWT features of the programmers model 

Chapter 9 summarizes the ITM features of the programmers model 

Chapter 10 summarizes the ETM features of the programmers model 
Chapter 11 summarizes the TPIU features of the programmers model. 
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3.2 Modes of operation and execution 


This section briefly describes the modes of operation and execution of the Cortex-M3 processor. 
See the ARMv7-M Architecture Reference Manual for more information. 


3.2.1 Operating modes 
The processor supports two modes of operation, Thread mode and Handler mode: 


e The processor enters Thread mode on Reset, or as a result of an exception return. 
Privileged and Unprivileged code can run in Thread mode. 


e The processor enters Handler mode as a result of an exception. All code is privileged in 
Handler mode. 


3.2.2 Operating states 
The processor can operate in one of two operating states: 


e Thumb state. This is normal execution running 16-bit and 32-bit halfword aligned Thumb 
instructions. 


e Debug State. This is the state when the processor is in halting debug. 


3.2.3 Privileged access and user access 


Code can execute as privileged or unprivileged. Unprivileged execution limits or excludes 
access to some resources. Privileged execution has access to all resources. Handler mode is 
always privileged. Thread mode can be privileged or unprivileged. 
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3.3 Instruction set summary 


This section provides information on: 


Cortex-M3 instructions 


Load/store timings on page 3-8 


Binary compatibility with other Cortex processors on page 3-9. 


3.3.1 Cortex-M3 instructions 


Programmers Model 


The processor implements the ARMv7-M Thumb instruction set. Table 3-1 shows the 
Cortex-M3 instructions and their cycle counts. The cycle counts are based on a system with zero 
wait states. 


Within the assembler syntax, depending on the operation, the <op2> field can be replaced with 
one of the following options: 


a simple register specifier, for example Rm 


an immediate shifted register, for example Rm, LSL #4 


a register shifted register, for example Rm, LSL Rs 


an immediate value, for example #0xEQQQE000. 


For brevity, not all load and store addressing modes are shown. See the ARMv7-M Architecture 
Reference Manual for more information. 


Table 3-1 uses the following abbreviations in the Cycles column: 


P 
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The number of cycles required for a pipeline refill. This ranges from 1 to 3 
depending on the alignment and width of the target instruction, and whether the 
processor manages to speculate the address early. 


The number of cycles required to perform the barrier operation. For DSB and DMB, 
the minimum number of cycles is zero. For ISB, the minimum number of cycles 
is equivalent to the number required for a pipeline refill. 


The number of registers in the register list to be loaded or stored, including PC or 


LR. 


The number of cycles spent waiting for an appropriate event. 


Table 3-1 Cortex-M3 instruction set summary 
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Operation Description Assembler Cycles 
Move Register MOV Rd, <op2> l 
16-bit immediate MOVW Rd, #<imm> 1 
Immediate into top MOVT Rd, #<imm> 1 
To PC MOV PC, Rm LFP 
Add Add ADD Rd, Rn, <op2> 1 
Add to PC ADD PC, PC, Rm LFP 
Add with carry ADC Rd, Rn, <op2> 1 
Form address ADR Rd, <label> 1 
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Table 3-1 Cortex-M3 instruction set summary (continued) 

























































































Operation Description Assembler Cycles 

Subtract Subtract SUB Rd, Rn, <op2> 1 
Subtract with borrow SBC Rd, Rn, <op2> 1 
Reverse RSB Rd, Rn, <op2> 1 

Multiply Multiply MUL Rd, Rn, Rm l 
Multiply accumulate MLA Rd, Rn, Rm 2 
Multiply subtract MLS Rd, Rn, Rm 2 
Long signed SMULL RdLo, RdHi, Rn, Rm 3 to 5a 
Long unsigned UMULL RdLo, RdHi, Rn, Rm 3 to 5a 
Long signed accumulate SMLAL RdLo, RdHi, Rn, Rm 4 to 74 
Long unsigned accumulate UMLAL RdLo, RdHi, Rn, Rm 4 to 78 

Divide Signed SDIV Rd, Rn, Rm 2 to 12> 
Unsigned UDIV Rd, Rn, Rm 2 to 12b 

Saturate Signed SSAT Rd, #<imm>, <op2> 1 
Unsigned USAT Rd, #<imm>, <op2> 1 

Compare Compare CMP Rn, <op2> 1 
Negative CMN Rn, <op2> l 

Logical AND AND Rd, Rn, <op2> 1 
Exclusive OR EOR Rd, Rn, <op2> 1 
OR ORR Rd, Rn, <op2> 1 
OR NOT ORN Rd, Rn, <op2> l 
Bit clear BIC Rd, Rn, <op2> 1 
Move NOT MVN Rd, <op2> 1 
AND test TST Rn, <op2> 1 
Exclusive OR test TEQ Rn, <op1> 

Shift Logical shift left LSL Rd, Rn, #<imm> 1 
Logical shift left LSL Rd, Rn, Rs l 
Logical shift right LSR Rd, Rn, #<imm> 1 
Logical shift right LSR Rd, Rn, Rs 1 
Arithmetic shift right ASR Rd, Rn, #<imm> 1 
Arithmetic shift right ASR Rd, Rn, Rs 1 
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Table 3-1 Cortex-M3 instruction set summary (continued) 




























































































Operation Description Assembler Cycles 
Rotate Rotate right ROR Rd, Rn, #<imm> 1 
Rotate right ROR Rd, Rn, Rs 1 
With extension RRX Rd, Rn 1 
Count Leading zeroes CLZ Rd, Rn l 
Load Word LDR Rd, [Rn, <op2>] 2c 
To PC LDR PC, [Rn, <op2>] 20+P 
Halfword LDRH Rd, [Rn, <op2>] 2c 
Byte LDRB Rd, [Rn, <op2>] 20 
Signed halfword LDRSH Rd, [Rn, <op2>] 20 
Signed byte LDRSB Rd, [Rn, <op2>] 2¢ 
User word LDRT Rd, [Rn, #<imm>] 2¢ 
User halfword LDRHT Rd, [Rn, #<imm>] 2c 
User byte LDRBT Rd, [Rn, #<imm>] 2c 
User signed halfword LDRSHT Rd, [Rn, #<imm>] 2c 
User signed byte LDRSBT Rd, [Rn, #<imm>] 2c 
PC relative LDR Rd,[PC, #<imm>] 20 
Doubleword LDRD Rd, Rd, [Rn, #<imm>] 1+N 
Multiple LDM Rn, {<reglist>} 1+N 
Multiple including PC LDM Rn, {<reglist>, PC} 1+N+P 
Store Word STR Rd, [Rn, <op2>] 2¢ 
Halfword STRH Rd, [Rn, <op2>] 2¢ 
Byte STRB Rd, [Rn, <op2>] 2¢ 
Signed halfword STRSH Rd, [Rn, <op2>] 2¢ 
Signed byte STRSB Rd, [Rn, <op2>] 2¢ 
User word STRT Rd, [Rn, #<imm>] 2¢ 
User halfword STRHT Rd, [Rn, #<imm>] 2¢ 
User byte STRBT Rd, [Rn, #<imm>] 2¢ 
User signed halfword STRSHT Rd, [Rn, #<imm>] 2¢ 
User signed byte STRSBT Rd, [Rn, #<imm>] 2¢ 
Doubleword STRD Rd, Rd, [Rn, #<imm>] 1+N 
Multiple STM Rn, {<reglist>} 1+N 
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Table 3-1 Cortex-M3 instruction set summary (continued) 




























































































Operation Description Assembler Cycles 
Push Push PUSH {<reglist>} 1+N 
Push with link register PUSH {<reglist>, LR} 1+N 
Pop Pop POP {<reglist>} 1+N 
Pop and return POP {<reglist>, PC} 1+N+P 
Semaphore Load exclusive LDREX Rd, [Rn, #<imm>] 2 
Load exclusive half LDREXH Rd, [Rn] 2 
Load exclusive byte LDREXB Rd, [Rn] 2 
Store exclusive STREX Rd, Rt, [Rn, #<imm>] 2 
Store exclusive half STREXH Rd, Rt, [Rn] 2 
Store exclusive byte STREXB Rd, Rt, [Rn] 2 
Clear exclusive monitor CLREX 1 
Branch Conditional B<cc> <label> l or 1 + P4 
Unconditional B <label> 1+P 
With link BL <label> LP 
With exchange BX Rm [SEP 
With link and exchange BLX Rm EP 
Branch if zero CBZ Rn, <label> l or 1 + Pd 
Branch if non-zero CBNZ Rn, <label> l or 1 + Pd 
Byte table branch TBB [Rn, Rm] ZA PP 
Halfword table branch TBH [Rn, Rm, LSL#1] 2+P 
State change Supervisor call SVC #<imm> - 
If-then-else IT... <cond> 1e 
Disable interrupts CPSID <flags> l or 2 
Enable interrupts CPSIE <flags> l or 2 
Read special register MRS Rd, <specreg> l or 2 
Write special register MSR <specreg>, Rn l or 2 
Breakpoint BKPT #<imm> - 
Extend Signed halfword to word SXTH Rd, <op2> l 
Signed byte to word SXTB Rd, <op2> 1 
Unsigned halfword UXTH Rd, <op2> l 
Unsigned byte UXTB Rd, <op2> l 
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Table 3-1 Cortex-M3 instruction set summary (continued) 


Operation Description Assembler Cycles 


Bit field Extract unsigned UBFX Rd, Rn, #<imm>, #<imm> 1 





Extract signed SBFX Rd, Rn, #<imm>, #<imm> 1 









































Clear BFC Rd, Rn, #<imm>, #<imm> 1 
Insert BFI Rd, Rn, #<imm>, #<imm> 1 
Reverse Bytes in word REV Rd, Rm 1 
Bytes in both halfwords REV16 Rd, Rm l 
Signed bottom halfword REVSH Rd, Rm 1 
Bits in word RBIT Rd, Rm 1 
Hint Send event SEV l 
Wait for event WFE 1+W 
Wait for interrupt WFI 1+W 
No operation NOP l 
Barriers Instruction synchronization ISB 1+B 
Data memory DMB 1+B 
Data synchronization DSB <flags> 1+B 


a. UMULL, SMULL, UMLAL, and SMLAL instructions use early termination depending on the size of 
the source values. These are interruptible, that is abandoned and restarted, with worst case 
latency of one cycle. 

b. Division operations use early termination to minimize the number of cycles required based 
on the number of leading ones and zeroes in the input operands. 

c. Neighboring load and store single instructions can pipeline their address and data phases. 
This enables these instructions to complete in a single execution cycle. 

d. Conditional branch completes in a single cycle if the branch is not taken. 

e. An IT instruction can be folded onto a preceding 16-bit Thumb instruction, enabling 
execution in zero cycles. 


3.3.2 Load/store timings 
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This section describes how best to pair instructions to achieve more reductions in timing. 


e STR Rx, [Ry,#imm] is always one cycle. This is because the address generation is performed 
in the initial cycle, and the data store is performed at the same time as the next instruction 
is executing. If the store is to the store buffer, and the store buffer is full or not enabled, 
the next instruction is delayed until the store can complete. If the store is not to the store 
buffer, for example to the Code segment, and that transaction stalls, the impact on timing 
is only felt if another load or store operation is executed before completion. 


e LDR Rx!, [any] is not normally pipelined. That is, base update load is generally at least a 
two-cycle operation (more if stalled). However, if the next instruction does not require to 
read from a register, the load is reduced to one cycle. Non register writing instructions 
include CMP, TST, NOP, and non-taken IT controlled instructions. 


e LDR PC, [any] is always a blocking operation. This means at least two cycles for the load, 
and three cycles for the pipeline reload. So this operation takes at least five cycles, or more 
if stalled on the load or the fetch. 
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e LDR Rx, [PC,#imm] might add a cycle because of contention with the fetch unit. 


. TBB and TBH are also blocking operations. These are at least two cycles for the load, one 
cycle for the add, and three cycles for the pipeline reload. This means at least six cycles, 
or more if stalled on the load or the fetch. 


e LDR [any] are pipelined when possible. This means that if the next instruction is an LDR or 
STR, and the destination of the first LDR is not used to compute the address for the next 
instruction, then one cycle is removed from the cost of the next instruction. So, an LDR 
might be followed by an STR, so that the STR writes out what the LDR loaded. More multiple 
LDRs can be pipelined together. Some optimized examples are: 


— LDR RQ@,[R1]; LDR R1, [R2] - normally three cycles total 
— LDR RQ@,[R1,R2]; STR RO, 
— LDR RQ@,[R1,R2]; STR R1, 
— LDR RQ@,[R1,R5]; LDR R1, 


R3,#20] - normally three cycles total 
R3,R2] - normally three cycles total 


] 

[ 

[ 

[R2]; LDR R2,[R3,#4] - normally four cycles total. 

e Other instructions cannot be pipelined after STR with register offset. STR can only be 
pipelined when it follows an LDR, but nothing can be pipelined after the store. Even a 


stalled STR normally only takes two cycles, because of the store buffer. 


. LDREX and STREX can be pipelined exactly as LDR. Because STREX 1s treated more like an LDR, 
1t can be pipelined as explained for LDR. Equally LDREX is treated exactly as an LDR and so 
can be pipelined. 


e LDRD and STRD cannot be pipelined with preceding or following instructions. However, the 
two words are pipelined together. So, this operation requires three cycles when not stalled. 


e LDM and STM cannot be pipelined with preceding or following instructions. However, all 
elements after the first are pipelined together. So, a three element LDM takes 2+1+1 or 5 
cycles when not stalled. Similarly, an eight element store takes nine cycles when not 
stalled. When interrupted, LDM and STM instructions continue from where they left off when 
returned to. The continue operation adds one or two cycles to the first element when 
started. 


e Unaligned word or halfword loads or stores add penalty cycles. A byte aligned halfword 
load or store adds one extra cycle to perform the operation as two bytes. A halfword 
aligned word load or store adds one extra cycle to perform the operation as two halfwords. 
A byte-aligned word load or store adds two extra cycles to perform the operation as a byte, 
a halfword, and a byte. These numbers increase if the memory stalls. A STR or STRH cannot 
delay the processor because of the store buffer. 


3.3.3 Binary compatibility with other Cortex processors 
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The processor implements a binary compatible subset of the instruction set and features 
provided by other Cortex-M profile processors. You can move software, including system level 
software, from the Cortex-M3 processor to other Cortex-M profile processors. 


To ensure a smooth transition, ARM recommends that code designed to operate on other 
Cortex-M profile processor architectures obey the following rules and configure the 
Configuration Control Register (CCR) appropriately: 


e use word transfers only to access registers in the NVIC and System Control Space (SCS). 
e treat all unused SCS registers and register fields on the processor as Do-Not-Modify. 


e configure the following fields in the CCR: 
— STKALIGN bit to 1 
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— UNALIGN TRP bit to 1 
— Leave all other bits in the CCR register as their original value. 
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3.4 System address map 


The processor contains a bus matrix that arbitrates the processor core and optional Debug 
Access Port (DAP) memory accesses to both the external memory system and to the internal 
System Control Space (SCS) and debug components. 


Priority is always given to the processor to ensure that any debug accesses are as non-intrusive 
as possible. For a zero wait state system, all debug accesses to system memory, SCS, and debug 
resources are completely non-intrusive. 


Figure 3-1 shows the system address map. 


0xE0100000 ~ n OxFFFFFFFF 
oxE00FFo00} ROM Tobe O External PPB System 

0xE0042000 a y 

oxeoo41oo0 —— =M | 0xE0100000 


oxtoo 0000 PA CTA | Private peripheral bus - External | | Private peripheral bus - External | bus - External 
0xE0040000 
| Private peripheral bus - Internal | | Private peripheral bus - Internal | bus - Internal 
0xE0040000 
oxe000r000[ Reseed 0xE0000000 
oxEoooeooo ___8CS_ — Reserved | 
oxE0003000 -———Reserved | E FPPB | External device 1.0GB 
oxEo002000 B | o ow 
oxEo001000 PWT AM 
oxEoooo009L TM | 0xA0000000 
0x44000000 






External RAM 1.0GB 


32MB Bit band alias 





0x42000000 And 
31MB | 
0x40100000}- Peripheral l 


0x40000000 L Bit 1MB  Bitband region | 1MB  Bitband region | 


0x24000000 0x40000000 


32MB Bit band alias SRAM 0.5GB 


0x22000000 0x20000000 
31MB eee 
0x20100000 H- cone | 


0x20000000 L Bit 1MB Bitbandregion | 1MB Bitbandregion | 





0x00000000 


Figure 3-1 System address map 


Table 3-2 shows the processor interfaces that are addressed by the different memory map 











regions. 
Table 3-2 Memory regions 
Memory Map Region 
Code Instruction fetches are performed over the ICode bus. Data accesses are performed over the DCode bus. 
SRAM Instruction fetches and data accesses are performed over the system bus. 
SRAM bit-band Alias region. Data accesses are aliases. Instruction accesses are not aliases. 
Peripheral Instruction fetches and data accesses are performed over the system bus. 
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Table 3-2 Memory regions (continued) 





Memory Map Region 
Peripheral bit-band Alias region. Data accesses are aliases. Instruction accesses are not aliases. 
External RAM Instruction fetches and data accesses are performed over the system bus. 





External Device 


Instruction fetches and data accesses are performed over the system bus. 





Private Peripheral Bus 


External and internal Private Peripheral Bus (PPB) interfaces. See Private peripheral bus. 


This memory region is Execute Never (XN), and so instruction fetches are prohibited. An MPU, if present, 
cannot change this. 





System 


System segment for vendor system peripherals. This memory region is XN, and so instruction fetches are 
prohibited. An MPU, if present, cannot change this. 


See the ARMv7-M Architecture Reference Manual for more information about the memory 
model. 


3.4.1 Private peripheral bus 


The internal Private Peripheral Bus (PPB) interface provides access to: 
e the Instrumentation Trace Macrocell (ITM) 

° the Data Watchpoint and Trace (DWT) 

. the Flashpatch and Breakpoint (FPB) 


e the System Control Space (SCS), including the Memory Protection Unit (MPU) and the 
Nested Vectored Interrupt Controller (NVIC). 


The external PPB interface provides access to: 

e the Trace Point Interface Unit (TPIU) 

e the Embedded Trace Macrocell (ETM) 

e the ROM table 

e implementation-specific areas of the PPB memory map. 


3.4.2 Unaligned accesses that cross regions 
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The Cortex-M3 processor supports ARMv7 unaligned accesses, and performs all accesses as 
single, unaligned accesses. They are converted into two or more aligned accesses by the DCode 
and System bus interfaces. 


Note 
All Cortex-M3 external accesses are aligned. 





Unaligned support is only available for load/store singles (LDR, STR). Load/store double already 
supports word aligned accesses, but does not permit other unaligned accesses, and generates a 
fault if this is attempted. 


Unaligned accesses that cross memory map boundaries are architecturally Unpredictable. The 
processor behavior is boundary dependent, as follows: 


e DCode accesses wrap within the region. For example, an unaligned halfword access to the 
last byte of Code space (0x1FFFFFFF) is converted by the DCode interface into a byte 
access to 0x1FFFFFFF followed by a byte access to 0x00000000. 
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e System accesses that cross into PPB space do not wrap within System space. For example, 
an unaligned halfword access to the last byte of System space (OxDFFFFFFF) is converted 
by the System interface into a byte access to OxDFFFFFFF followed by a byte access to 
0xE0000000. 0xE0000000 1s not a valid address on the System bus. 


e System accesses that cross into Code space do not wrap within System space. For 
example, an unaligned halfword access to the last byte of System space (0xFFFFFFFF) is 
converted by the System interface into a byte access to OxFFFFFFFF followed by a byte 
access to 0x00000000. 0x00000000 is not a valid address on the System bus. 


e Unaligned accesses are not supported to PPB space, and so there are no boundary crossing 
cases for PPB accesses. 


Unaligned accesses that cross into the bit-band alias regions are also architecturally 
Unpredictable. The processor performs the access to the bit-band alias address, but this does not 
result in a bit-band operation. For example, an unaligned halfword access to 0x21FFFFFF is 
performed as a byte access to 0x21FFFFFF followed by a byte access to 0x22000000 (the first byte 
of the bit-band alias). 


Unaligned loads that match against a literal comparator in the FPB are not remapped. FPB only 
remaps aligned addresses. 
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To prevent bus wait cycles from stalling the processor during data stores, buffered stores to the 
DCode and System buses go through a one-entry write buffer. If the write buffer is full, 
subsequent accesses to the bus stall until the write buffer has drained. The write buffer is only 
used if the bus waits the data phase of the buffered store, otherwise the transaction completes 
on the bus. 


DMB and DSB instructions wait for the write buffer to drain before completing. If an interrupt 
comes in while DMB or DSB is waiting for the write buffer to drain, the processor returns to the 
instruction following the DMB or DSB after the interrupt completes. This is because interrupt 
processing acts as a memory barrier operation. 
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3.6 Exclusive monitor 
The Cortex-M3 processor implements a local exclusive monitor. For more information about 
semaphores and the local exclusive monitor see the ARMv7M ARM Architecture Reference 
Manual. 
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3.7 Bit-banding 


Bit-banding maps a complete word of memory onto a single bit in the bit-band region. For 
example, writing to one of the alias words sets or clears the corresponding bit in the bit-band 
region. This enables every individual bit in the bit-banding region to be directly accessible from 
a word-aligned address using a single LDR instruction. It also enables individual bits to be toggled 
without performing a read-modify-write sequence of instructions. 


The processor memory map includes two bit-band regions. These occupy the lowest 1MB ofthe 
SRAM and Peripheral memory regions respectively. These bit-band regions map each word in 
an alias region of memory to a bit in a bit-band region of memory. 


The System bus interface contains logic that controls bit-band accesses as follows: 
e It remaps bit-band alias addresses to the bit-band region. 


e For reads, it extracts the requested bit from the read byte, and returns this in the Least 
Significant Bit (LSB) of the read data returned to the core. 


e For writes, it converts the write to an atomic read-modify-write operation. 


e The processor does not stall during bit-band operations unless it attempts to access the 
System bus while the bit-band operation is being carried out. 


The memory map has two 32-MB alias regions that map to two 1-MB bit-band regions: 
e Accesses to the 32-MB SRAM alias region map to the 1-MB SRAM bit-band region. 


e Accesses to the 32-MB peripheral alias region map to the 1-MB peripheral bit-band 
region. 


A mapping formula shows how to reference each word in the alias region to a corresponding bit, 
or target bit, in the bit-band region. The mapping formula is: 


bit_word_offset = (byte_offset x 32) + (bit_number x 4) 
bit_word_addr = bit_band_base + b1t_word_offset 
where: 


. bit_word_offset is the position of the target bit in the bit-band memory region. 


e bit_word_addr is the address of the word in the alias memory region that maps to the 
targeted bit. 
e bit_band_base is the starting address of the alias region. 


e byte_offset is the number of the byte in the bit-band region that contains the targeted bit. 
e bit_number is the bit position, 0 to 7, of the targeted bit. 


Figure 3-2 on page 3-17 shows examples of bit-band mapping between the SRAM bit-band 
alias region and the SRAM bit-band region: 


e The alias word at 0x23FFFFE0 maps to bit [0] of the bit-band byte at 0x200FFFFF: 0x23FFFFEO 
= 0x22000000 + (OxFFFFF*32) + 0*4. 


. The alias word at 0x23FFFFFC maps to bit [7] of the bit-band byte at 0x200FFFFF: 0x23FFFFFC 
= 0x22000000 + (OxFFFFF*32) + 7*4. 


e The alias word at 0x22000000 maps to bit [0] ofthe bit-band byte at 0x20000000: 0x22000000 
= 0x22000000 + (0*32) + 0*4. 
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e The alias word at 0x2200001C maps to bit [7] of the bit-band byte at 0x20000000: 0x2200001C 
= 0x22000000 + (0*32) + 7*4. 


32MB alias region 


0x23FFFFFC | 0x23FFFFF8 | 0x23FFFFF4 | Ox23FFFFFO | 0x23FFFFEC | 0x23FFFFE8 | 0x23FFFFE4 | 0x23FFFFEO 


lA C 0x22000018 0x22000014 E 0 0x2200000C 0x22000008 0x22000004 0x22000000 


SS as 1MB SRAM bit-band region 


7 6 5 4 3 2 6 5 43.21 ff O54 8 2 0 7 6 5 4 3 2 0 7 6 5 4 3 2 


B 0x200FFFFF UT 0x200FFFFE ATT Ox200FFFFD TTT Ox200FFFFC T 


o 
o 


o 


7 6 5 4 3 2 0 7 6 5 4 3 2 0 7 6 5 4 3 2 O04A7 6 5 4 3 2 


AN 0x20000003 TTT 0x20000002 TTT 0x20000001 Tir 0x20000000 g 





Figure 3-2 Bit-band mapping 


3.7.1 Directly accessing an alias region 


Writing to a word in the alias region has the same effect as a read-modify-write operation on the 
targeted bit in the bit-band region. 


Bit [0] of the value written to a word in the alias region determines the value written to the 
targeted bit in the bit-band region. Writing a value with bit [0] set writes a 1 to the bit-band bit, 
and writing a value with bit [0] cleared writes a 0 to the bit-band bit. 


Bits [31:1] of the alias word have no effect on the bit-band bit. Writing 0x01 has the same effect 
as writing 0xFF. Writing 0x00 has the same effect as writing 0x0E. 


Reading a word in the alias region returns either 0x01 or 0x00. A value of 0x01 indicates that the 
targeted bit in the bit-band region is set. A value of 0x00 indicates that the targeted bit is clear. 
Bits [31:1] are zero. 


3.7.2 Directly accessing a bit-band region 


You can directly access the bit-band region with normal reads and writes to that region. 


ARM DDI 0337H Copyright © 2005-2008, 2010 ARM Limited. All rights reserved. 3-17 
IDO32710 Non-Confidential 


Programmers Model 


3.8 Processor core register summary 
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The processor has the following 32-bit registers: 


e 13 general-purpose registers, r0-r12 


e Stack Pointer (SP) alias of banked registers, SP_process and SP_main 
. Link Register (LR), r14 

° Program Counter (PC), r15 

e Special-purpose Program Status Registers, (xPSR). 


Figure 3-3 shows the processor register set. 


low registers 


high registers 


Program Status Register 





Figure 3-3 Processor register set 


The general-purpose registers r0-r12 have no special architecturally-defined uses. Most 
instructions that can specify a general-purpose register can specify r0-r12. 


Low registers 


High registers 


Registers r0-r7 are accessible by all instructions that specify a 
general-purpose register. 


Registers r8-r12 are accessible by all 32-bit instructions that specify a 
general-purpose register. 


Registers r8-r12 are not accessible by all 16-bit instructions. 


Registers r13, r14, and r15 have the following special functions: 


Stack pointer 


Link register 


Program counter 


Register r13 1s used as the Stack Pointer (SP). Because the SP 1gnores 
writes to bits [1:0], it is autoaligned to a word, four-byte boundary. 


Handler mode always uses SP_main, but you can configure Thread mode 
to use either SP_ main or SP process. 
Register r14 is the subroutine Link Register (LR). 


The LR receives the return address from PC when a Branch and Link (BL) 
or Branch and Link with Exchange (BLX) instruction 1s executed. 


The LR is also used for exception return. 


At all other times, you can treat r14 as a general-purpose register. 


Register r15 1s the Program Counter (PC). 
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Bit [0] is always 0, so instructions are always aligned to word or halfword 
boundaries. 


See the ARMv7-M Architecture Reference Manual for more information. 
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The processor and the Nested Vectored Interrupt Controller (NVIC) prioritize and handle all 
exceptions. When handling exceptions: 


e All exceptions are handled in Handler mode. 


. Processor state 1s automatically stored to the stack on an exception, and automatically 
restored from the stack at the end of the Interrupt Service Routine (ISR). 


e The vector is fetched in parallel to the state saving, enabling efficient interrupt entry. 


The processor supports tail-chaining that enables back-to-back interrupts without the overhead 
of state saving and restoration. 


You configure the number of interrupts, and bits of interrupt priority, during implementation. 
Software can choose only to enable a subset of the configured number of interrupts, and can 
choose how many bits of the configured priorities to use. 


Note 


Vector table entries are compatible with interworking between ARM and Thumb instructions. 
This causes bit [0] of the vector value to load into the Execution Program Status Register 
(EPSR) T-bit on exception entry. All vector table entries must have bit [0] set. Creating a table 
entry with bit [0] clear generates an INVSTATE fault on the first instruction of the handler 
corresponding to this vector. 





3.9.1 Exception handling 
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The processor implements advanced exception and interrupt handling, as described in the 
ARMv/7-M Architecture Reference Manual. 


To reduce interrupt latency, the processor implements both interrupt late-arrival and interrupt 
tail-chaining mechanisms, as defined by the ARMv7-M architecture: 


e There is a maximum ofa 12 cycle latency from asserting the interrupt to execution of the 
first instruction of the ISR when the memory being accessed has no wait states being 
applied. The first instruction to be executed is fetched in parallel to the stack push. 


e Returns from interrupts similarly take twelve cycles where the instruction being returned 
to is fetched in parallel to the stack pop. 


e Tail chaining requires 6 cycles when using zero wait state memory. No stack pushes or 
pops are performed and only the instruction for the next ISR is fetched. 


The processor exception model has the following implementation-defined behavior in addition 
to the architecturally defined behavior: 


e exceptions on stacking from HardFault to NMI lockup at NMI priority 
e exceptions on unstacking from NMI to HardFault lockup at HardFault priority. 


To minimize interrupt latency, the processor abandons any divide instruction to take any 
pending interrupt. On return from the interrupt handler, the processor restarts the divide 
instruction from the beginning The processor implements the Interruptible-continuable 
Instruction field. Load multiple (LDM) operations and store multiple (STM) operations are 
interruptible. The ICI field of the EPSR holds the information required to continue the load or 
store multiple from the point where the interrupt occurred. 
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This means that software must not use load-multiple or store-multiple instructions to access a 
device or memory region that is read-sensitive or sensitive to repeated writes. The software must 
not use these instructions in any case where repeated reads or writes might cause inconsistent 
results or unwanted side-effects. 


Base register update in LDM and STM operations 


There are cases when an LDM or STM updates the base register: 


e When the instruction specifies base register write-back, the base register changes to the 
updated address. An abort restores the original base value. 


e When the base register is in the register list of an LDM, and is not the last register in the list, 
the base register changes to the loaded value. 


An LDM or STM is restarted rather than continued if: 
. the instruction faults 
° the instruction is inside an IT. 


If an LDM has completed a base load, it is continued from before the base load. 
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This chapter describes the registers that program the processor. It contains the following sections: 


° About system control on page 4-2 
. Register summary on page 4-3 
° Register descriptions on page 4-5. 
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4.1 About system control 
This chapter describes the registers that control the operation of the processor. 
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4-2 


4.2 


Register summary 


System Control 


Table 4-1 shows the system control registers. Registers not described in this chapter are 
described in the ARMv7-M Architecture Reference Manual 


Table 4-1 System control registers 
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Address Name Type Reset Description 
0xE000E008 ACTLR RW 0x00000000 Auxiliary Control Register, ACTLR on page 4-5 
0xE000E010 STCSR RW 0x00000000 SysTick Control and Status Register 
0xE000E014 STRVR RW Unknown SysTick Reload Value Register 
0xE000E018 STCVR RW clear Unknown SysTick Current Value Register 
0xE000E01C STCR RO Implementation specific SysTick Calibration Value Register 
0xE000ED0OO. CPUID RO 0x412FC230 CPUID Base Register, CPUID on page 4-5 
0xE000ED0O4 ICSR RW or RO  0x00000000 Interrupt Control and State Register 
QxEQQ0ED08 VITOR RW 0x00000000 Vector Table Offset Register 
OxE000EDO0OC— AIRCR RW 0x000000008 Application Interrupt and Reset Control Register 
QxEQQ0ED10 SCR RW 0x00000000 System Control Register 
0xE000ED1I4 CCR RW 0x00000200 Configuration and Control Register. 
0xE000ED18  SHPRI RW 0x00000000 System Handler Priority Register 1 
0xE000EDIC SHPR2 RW 0x00000000 System Handler Priority Register 2 
0xE000ED20. SHPR3 RW 0x00000000 System Handler Priority Register 3 
0xE000ED24 SHCSR RW 0x00000000 System Handler Control and State Register 
0xE000ED28 CFSR RW 0x00000000 Configurable Fault Status Registers 
Q@xEQQQED2C HFSR RW 0x00000000 HardFault Status register 
QxEQQ0ED30 DFSR RW 0x00000000 Debug Fault Status Register 
0xE000ED34 MMFAR RW Unknown MemManage Address Register? 
0xE000ED38 BFAR RW Unknown BusFault Address Registerb 
Q@xEQQQED3C + AFSR RW 0x00000000 Auxiliary Fault Status Register, AFSR on page 4-6 
0xE000ED40 ID PFRO RO 0x00000030 Processor Feature Register O 
0xE000ED44 ID PFRI RO 0x00000200 Processor Feature Register 1 
0xE000ED48 ID DFRO RO 0x00100000 Debug Features Register 0 
@xEQQ0ED4C ID AFRO RO 0x00000000 Auxiliary Features Register 0 
0xE000ED50 ID MMFRO RO 0x00000030 Memory Model Feature Register O 
0xE000ED54 ID MMFRI RO 0x00000000 Memory Model Feature Register 1 
0xE000ED58 ID MMFR2 RO 0x00000000 Memory Model Feature Register 2 
OxE000ED5C ID MMFR3 RO 0x00000000 Memory Model Feature Register 3 
0xE000ED60 ID ISARO RO 0x01141110 Instruction Set Attributes Register O 
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Table 4-1 System control registers (continued) 

















Address Name Type Reset Description 

0xE000ED64 ID ISARI RO 0x02112000 Instruction Set Attributes Register 1 
0xE000ED68 ID ISAR2 RO 0x21232231 Instruction Set Attributes Register 2 
0xE000ED6EC ID ISAR3 RO 0x01111131 Instruction Set Attributes Register 3 
0xE000ED70 ID ISAR4 RO 0x01310102 Instruction Set Attributes Register 4 
0xE000ED88 CPACR RW 0x00000000 Coprocessor Access Control Register 
0xE000EF0O STIR WO 0x00000000 Software Triggered Interrupt Register 


a. Bits [10:8] are reset to zero. The ENDIANNESS bit, bit [15], can reset to either state, depending on the implementation. 
b. BFAR and MFAR are the same physical register. Because of this, the BFARVALID and MFAEVALID bits are mutually 
exclusive. 
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4.3 Register descriptions 
This section describes the system control registers whose implementation is specific to this 
processor. 
4.3.1 Auxiliary Control Register, ACTLR 
The ACTLR characteristics are: 
Purpose Disables certain aspects of functionality within the processor. 
Usage Constraints There are no usage constraints. 
Configurations This register is available in all processor configurations. 
Attributes See the register summary in Table 4-1 on page 4-3. 
Figure 4-1 shows the ACTLR bit assignments. 
eT 
DISFOLD 4 | 
DISDEFWBUF 
DISMCYCINT 
Figure 4-1 ACTLR bit assignments 
Table 4-2 shows the ACTLR bit assignments. 
Table 4-2 ACTLR bit assignments 

Bits Name Function 

[31:3] - Reserved 

[2] DISFOLD Disables folding of IT instructions. 

[1] DISDEFWBUF Disables write buffer use during default memory map accesses. This causes all bus faults to be precise, 
but decreases the performance of the processor because stores to memory must complete before the 
next instruction can be executed. 

[0] DISMCYCINT Disables interruption of multi-cycle instructions. This increases the interrupt latency of the processor 
because load/store and multiply/divide operations complete before interrupt stacking occurs. 

4.3.2 CPUID Base Register, CPUID 
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The CPUID characteristics are: 


Purpose Specifies: 
e the ID number of the processor core 
e the version number of the processor core 
e the implementation details of the processor core. 


Usage Constraints There are no usage constraints. 


Configurations This register is available in all processor configurations. 


Attributes See the register summary in Table 4-1 on page 4-3. 
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Figure 4-2 shows the CPUID bit assignments. 


31 | 24 23 20 19 16 15 | e 4:3 o 


IMPLEMENTER VARIANT | (Constant) PARTNO REVISION 


Figure 4-2 CPUID bit assignments 
Table 4-3 shows the CPUID bit assignments. 


Table 4-3 CPUID bit assignments 
Bits NAME Function 


[31:24] IMPLEMENTER Indicates implementor: 0x41 = ARM 














[23:20] VARIANT Indicates processor revision: 0x2 = Revision 2 
[19:16] (Constant) Reads as 0xF 

[15:4] PARTNO Indicates part number: 0xC23 = Cortex-M3 
[3:0] REVISION Indicates patch release: 0x0 = Patch 0. 


4.3.3 Auxiliary Fault Status Register, AFSR 
The AFSR characteristics are: 
Purpose Specifies additional system fault information to software. 


Usage Constraints The AFSR flags map directly onto the AUXFAULT inputs of the 
processor, and a single-cycle high level on an external pin causes the 
corresponding AFSR bit to become latched as one. The bit can only be 
cleared by writing a one to the corresponding AFSR bit. 


When an AFSR bit is written or latched as one, an exception does not 
occur. If you require an exception, you must use an interrupt. 


Configurations This register is available in all processor configurations. 
Attributes See the register summary in Table 4-1 on page 4-3. 


Figure 4-3 shows the AFSR bit assignments. 


AUXFAULT 


Figure 4-3 AFSR bit assignments 
Table 4-4 shows the AFSR bit assignments. 


Table 4-4 AFSR bit assignments 
Bits Name Function 


[31:0] _AUXFAULT  Latched version of the AUXFAULT inputs. 
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Memory Protection Unit 
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This chapter describes the processor Memory Protection Unit (MPU). It contains the following 
sections: 


e About the MPU on page 5-2 
e MPU functional description on page 5-3 
e MPU programmers model on page 5-4. 
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5.1 About the MPU 


ARM DDI 0337H 
ID032710 


The MPU 1s an optional component for memory protection. The processor supports the standard 
ARMv7 Protected Memory System Architecture model. The MPU provides full support for: 


° protection regions 

e overlapping protection regions, with ascending region priority: 
— 7= highest priority 
—  0=lowest priority. 

e access permissions 


e exporting memory attributes to the system. 


MPU mismatches and permission violations invoke the programmable-priority MemManage 
fault handler. See the ARMv7-M Architecture Reference Manual for more information. 


You can use the MPU to: 
e enforce privilege rules 
. separate processes 
° enforce access rules. 
Copyright © 2005-2008, 2010 ARM Limited. All rights reserved. 5-2 


Non-Confidential 


Memory Protection Unit 


5.2 MPU functional description 
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The attribute bits, TEX, C, B, AP, and XN, of the Region Access Control Register control access 
to the corresponding memory region. If an access is made to an area of memory without the 
required permissions, then a permission fault is raised. For more information, see the ARMv7-M 
Architecture Reference Manual. 
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Memory Protection Unit 


Table 5-5 shows the MPU registers. These registers are described in the ARMv7-M Architecture 
































Reference Manual. 
Table 5-1 MPU registers 
Address Name Type Reset Description 
Q@xEQQQED99 MPU TYPE RO 0x000008002 MPU Type Register 
Q@xEQQ0ED94 MPU CTRL RW 0x00000000 MPU Control Register 
0xE000ED98 MPU RNR RW - MPU Region Number Register 
OxE000EDIC MPU RBAR RW - MPU Region Base Address Register 
OxE000EDAO. MPU RASR RW - MPU Region Attribute and Size Register 
Q@xEQQQEDA4 MPU RBAR Al - MPU alias registers 
0xE000EDA8 MPU RASR Al - 
Q@xEQQQ@EDAC MPU RBAR A2 - 
0xE000EDBO MPU RASR A2 - 
0xE000EDB4 MPU RBAR A3 - 
QxEQQ0EDB8 MPU RASR A3 : 


a. Ifthe MPU is not present in the implementation, then this register reads as zero. 
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Chapter 6 
Nested Vectored Interrupt Controller 


This chapter describes the Nested Vectored Interrupt Controller (NVIC). It contains the following 
sections: 


e About the NVIC on page 6-2 
e NVIC functional description on page 6-3 
e NVIC programmers model on page 6-4. 
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6.1 About the NVIC 
The NVIC provides configurable interrupt handling abilities to the processor. It: 
e facilitates low-latency exception and interrupt handling 
: controls power management 
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6.2 NVIC functional description 


The NVIC supports up to 240 interrupts each with up to 256 levels of priority. You can change 
the priority of an interrupt dynamically. The NVIC and the processor core interface are closely 
coupled, to enable low latency interrupt processing and efficient processing of late arriving 
interrupts. The NVIC maintains knowledge of the stacked, or nested, interrupts to enable 
tail-chaining of interrupts. 


You can only fully access the NVIC from privileged mode, but you can cause interrupts to enter 
a pending state in user mode if you enable this capability using the Configuration Control 
Register. Any other user mode access causes a bus fault. 


You can access all NVIC registers using byte, halfword, and word accesses unless otherwise 
stated. NVIC registers are located within the SCS. 


All NVIC registers and system debug registers are little-endian regardless of the endianness 
state of the processor. 


Processor exception handling is described in Exceptions on page 3-20. 


6.2.1 Low power modes 


Your implementation can include a Wake-up Interrupt Controller (WIC). This enables the 
processor and NVIC to be put into a very low-power sleep mode leaving the WIC to identify 
and prioritize interrupts. 


The processor fully implements the Wait For Interrupt (WF1), Wait For Event (WFE) and the Send 
Event (SEV) instructions. In addition, the processor also supports the use of SLEEPONEXIT, that 
causes the processor core to enter sleep mode when it returns from an exception handler to 
Thread mode. See the ARMv7-M Architecture Reference Manual for more information. 


6.2.2 Level versus pulse interrupts 


The processor supports both level and pulse interrupts. A level interrupt is held asserted until it 
is cleared by the ISR accessing the device. A pulse interrupt is a variant of an edge model. 


For level interrupts, if the signal is not deasserted before the return from the interrupt routine, 

the interrupt again enters the pending state and re-activates. This is particularly useful for FIFO 
and buffer-based devices because it ensures that they drain either by a single ISR or by repeated 
invocations, with no extra work. This means that the device holds the signal in assert until the 
device is empty. 


A pulse interrupt can be reasserted during the ISR so that the interrupt can be in the pending 
state and active at the same time. The application design must ensure that a second pulse does 
not arrive before the first pulse is activated. The second entry to the pending state has no affect 
because it is already in that state. However, if the interrupt is asserted for at least one cycle, the 
NVIC latches the pend bit. When the ISR activates, the pend bit is cleared. If the interrupt asserts 
again while it is activated, it can latch the pend bit again. 


Pulse interrupts are mostly used for external signals and for rate or repeat signals. 
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6.3 NVIC programmers model 
Table 6-1 shows the NVIC registers. 


Table 6-1 NVIC registers 




















Address Name Type Reset Description 

0xE000E004 ICTR RO - Interrupt Controller Type Register, ICTR 
0xE000E100 - NVIC ISERO- RW 0x00000000 Interrupt Set-Enable Registers 
OXE000E11C NVIC_ISER7 

0xE000E180 - NVIC ICERO- RW 0x00000000 Interrupt Clear-Enable Registers 
QE000xE19C NVIC_ICER7 

0xE000E200 - NVIC ISPRO- RW 0x00000000 Interrupt Set-Pending Registers 
QxEQ00E21C NVIC_ISPR7 

0xE000E280 - NVIC ICPRO- RW 0x00000000 Interrupt Clear-Pending Registers 
0xE000E29C NVIC_ICPR7 

0xE000E300 - NVIC IABRO- RO 0x00000000 Interrupt Active Bit Register 
0xE000E31C NVIC_IABR7 

0xE000E400 - NVIC_IPRO - RW 0x00000000 Interrupt Priority Register 
OxEQQQE41F NVIC_IPR59 


The following sections describe the NVIC registers whose implementation is specific to this 

processor. Other registers are described in the ARMv7M Architecture Reference Manual. 
6.3.1 Interrupt Controller Type Register, ICTR 

The ICTR characteristics are: 

Purpose Shows the number of interrupt lines that the NVIC supports. 

Usage Constraints There are no usage constraints. 

Configurations This register is available in all processor configurations. 

Attributes See the register summary in Table 6-1. 


Figure 6-1 shows the ICTR bit assignments. 


31 : e | | 4 3 o 
O ee 
a 


Figure 6-1 ICTR bit assignments 
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Table 6-2 shows the ICTR bit assignments. 


Bits Name 


[31:4] - 


Nested Vectored Interrupt Controller 


Table 6-2 ICTR bit assignments 


Function 


Reserved. 





[3:0] | INTLINESNUM 


Total number of interrupt lines in groups of 32: 
b0000 = 0...32 

b0001 = 33...64 

b0010 = 65...96 

b0011 = 97...128 

b0100 = 129...160 

b0101 = 161...192 

b0110 = 193...224 

b0111 = 225...2568 


a. The processor supports a maximum of 240 external interrupts. 
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This chapter describes how to debug and test software running on the processor. It contains the 
following sections: 


e About debug on page 7-2 
. About the AHB-AP on page 7-6 
e About the Flash Patch and Breakpoint Unit (FPB) on page 7-9. 
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7.1 About debug 


The processor implementation determines the debug configuration, including whether debug is 
implemented. If the processor does not implement debug, no ROM table is present and the halt, 
breakpoint, and watchpoint functionality is not present. 


Basic debug functionality includes processor halt, single-step, processor core register access, 
Vector Catch, unlimited software breakpoints, and full system memory access. See the 
ARMv/7-M Architectural Reference Manual for more information. 


The debug option might include: 


e a breakpoint unit supporting 2 literal comparators and 6 instruction comparators, or only 
2 instruction comparators 


e a watchpoint unit supporting 1 or 4 watchpoints. 


For processors that implement debug, ARM recommends that a debugger identify and connect 
to the debug components using the CoreSight debug infrastructure. 


Figure 7-1 shows the recommended flow that a debugger can follow to discover the components 
in the CoreSight debug infrastructure. In this case a debugger reads the peripheral and 
component ID registers for each CoreSight component in the CoreSight system. 


CoreSight debug port 


CoreSight access port 


Redirection from the 
+ System ROM table, if implemented 











Cortex-M3 ROM table 


CoreSight ID 


Pointers 
ee ee 


System control space j Data watchpoint unit + Breakpoint unit 


CoreSight ID CoreSight ID 


CoreSight ID 


Watchpoint control Breakpoint control 


Cortex-M3 CPUID 





Debug control 





+ Optional component 


Figure 7-1 CoreSight discovery 


To identify the Cortex-M3 processor within the CoreSight system, ARM recommends that a 
debugger perform the following actions: 


1. Locate and identify the Cortex-M3 ROM table using its CoreSight identification. See 
Table 7-1 on page 7-3 for more information. 
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2. Follow the pointers in that Cortex-M3 ROM table: 
a. System Control Space (SCS) 
b. Breakpoint unit (BPU) 
c. Data watchpoint unit (DWT). 


See Table 7-2 for more information. 


When a debugger identifies the SCS from its CoreSight identification, it can identify the 
processor and its revision number from the CPUID register in the SCS at address 0xE000ED00. 


A debugger cannot rely on the Cortex-M3 ROM table being the first ROM table encountered. 
One or more system ROM tables are required between the access port and the Cortex-M3 ROM 
table if other CoreSight components are in the system. If a system ROM table is present, this 
can include a unique identifier for the implementation. 
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7.1.1 Cortex-M3 ROM table identification and entries 
Table 7-1 shows the ROM table identification registers and values for debugger detection. This 
permits debuggers to identify the processor and its debug capabilities. 
Note 
The Cortex-M3 ROM table only supports word size transactions. 
Table 7-1 Cortex-M3 ROM table identification values 
Address Register Value Description 
QxEQOFFFD@ Peripheral ID4 0x00000000 Component and Peripheral ID register formats in the ARMv7-M Architectural 
: Reference Manual 
OxE00FFFEO Peripheral IDO 0x00000000 
Note 
OXEOOEPTEN: PRENpREraL TEI PRA p These are the default values for the Peripheral ID registers if the ROM table 
OXE00FFFES Peripheral ID2 0x00000000 has not been configured at implementation. Your implementation might use 
these registers to identify the manufacturer and part number for the device. 
OxEQOFFFEC Peripheral ID3  0x0000000 . The Component ID registers identify this as a CoreSight ROM table. 
QxEQQ@FFFFO Component IDO  0x0000000D 
OXxE00FFFF4 Component ID1  0x00000010 
OXxE00FFFF8 Component ID2 @0x00000005 
QxEQ@FFFFC Component ID3 0x000000B1 


Table 7-2 shows the CoreSight components that the Cortex-M3 ROM table points to. The values 
depend on the implemented debug configuration. 


Table 7-2 Cortex-M3 ROM table components 











Address Component Value Description 

OxE0OFFO00 SCS OxFFFOF003 See System Control Space on page 7-4 
0xE00FF004 DWT QxFFFQ20032 See Table 8-1 on page 8-4 

0xE00FF008 FPB QxFFFO30035 See Table 7-7 on page 7-10 
OxE00FFO0C ITM QxFFFQ1003¢ See Table 9-1 on page 9-4 
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Table 7-2 Cortex-M3 ROM table components (continued) 








Address Component Value Description 

QxEQQFF010 TPIU QxFFF410034 See Table 11-1 on page 11-5 

0xE00FF014 ETM 0xFFF420032 See Chapter 10 Embedded Trace Macrocell. 
0xE00FF018 End marker 0x00000000 See DAP accessible ROM table in the ARMv7-M 





Architectural Reference Manual 
OXE00FFFCC SYSTEM ACCESS — 0x00000001 


Reads as 0xFFF02002 if no watchpoints are implemented. 
Reads as 0xFFF03002 if no breakpoints are implemented. 
Reads as 0xFFFQ1002 if no ITM is implemented. 

Reads as 0xFFF41002 if no TPIU is implemented. 

Reads as @xFFF42002 if no ETM is implemented. 


RPT 


The ROM table entries point to the debug components of the processor. The offset for each entry 
is the offset of that component from the ROM table base address, 0xE00FF000. 


See the ARMv7-M Architectural Reference Manual and the ARM CoreSight Components 
Technical Reference Manual for more information about the ROM table ID and component 
registers, and their addresses and access types. 


7.1.2 System Control Space 


If debug is implemented, the processor provides debug through registers in the SCS. See: 
° Debug register summary on page 7-5 
° System address map on page 3-11. 


SCS CoreSight identification 


Table 7-3 shows the SCS CoreSight identification registers and values for debugger detection. 
Final debugger identification of the Cortex-M3 processor is through the CPUID register in the 
SCS. See CPUID Base Register, CPUID on page 4-5. 


Table 7-3 SCS identification values 
Address Register Value Description 


OxE00QEFDO Peripheral ID4 0x00000004 Component and Peripheral ID register formats in 
the ARMv7-M Architectural Reference Manual 





QxEQQQEFEQ Peripheral IDO 0x0000000C 





Q@xEQQQEFE4 Peripheral ID1 0x000000B0 





Q@xEQQQEFE8 Peripheral ID2 0x0000000B 





Q@xEQQQEFEC Peripheral ID3 0x00000000 





0xE000EFFO. Component IDO  0x0000000D 





0xE000EFF4 ComponentID1 0x000000E0 





0xE000EFF8 Component ID2  0x00000005 





Q@xEQQ@EFFC Component ID3 @x000000B1 


See the ARMv7-M Architectural Reference Manual and the ARM CoreSight Components 
Technical Reference Manual for more information about the SCS CoreSight identification 
registers, and their addresses and access types. 
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7.1.3 Debug register summary 


Table 7-4 shows the debug registers. Each of these registers is 32 bits wide and is described in 
the ARMv7-M Architectural Reference Manual. 


Table 7-4 Debug registers 


Address Name Type Reset Description 


0xE000ED30 DFSR RW 0x000000002 Debug Fault Status Register 





OxE000EDFO + DHCSR RW 0x00000000 Debug Halting Control and Status Register 





Q@xEQQQEDF4 DCRSR WO - Debug Core Register Selector Register 





0xE000EDF8 DCRDR RW - Debug Core Register Data Register 





0xE000EDFC DEMCR RW 0x00000000 Debug Exception and Monitor Control Register 
a. Power-on reset only 
Core debug is an optional component. If core debug is removed then halt mode debugging is not 


supported, and there is no halt, stepping, or register transfer functionality. Debug monitor mode 
is still supported. 
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7.2 About the AHB-AP 


The AHB-AP is a Memory Access Port (MEM-AP) as defined in the ARM Debug Interface v5 
Architecture Specification. The AHB-AP 1s an optional debug access port into the Cortex-M3 
system, and provides access to all memory and registers in the system, including processor 
registers through the SCS. System access is independent of the processor status. Either SW-DP 
or SWJ-DP is used to access the AHB-AP. 


The AHB-AP is a master into the Bus Matrix. Transactions are made using the AHB-AP 
programmers model, which generates AHB-Lite transactions into the Bus Matrix. 


7.2.1 AHB-AP transaction types 


The AHB-AP does not perform back-to-back transactions on the bus, and so all transactions are 
non-sequential. The AHB-AP can perform unaligned and bit-band transactions. The Bus Matrix 
handles these. The AHB-AP transactions are not subjectto MPU lookups. AHB-AP transactions 
bypass the FPB, and so the FPB cannot remap AHB-AP transactions. 


AHB-AP transactions are little-endian. 


7.2.2  AHB-AP programmers model 
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Table 7-5 shows the AHB-AP registers. If the AHB-AP is not present, these registers read as 
zero. Any register that is not specified in this table reads as zero. 


Table 7-5 AHB-AP register summary 


























Offset? Name Type Reset Description 

0x00 CSW RW See register AHB-AP Control and Status Word Register, CSW 
0x04 TAR RW - AHB-AP Transfer Address Register 

Qx0C DRW RW - AHB-AP Data Read/Write Register 

0x10 BDO RW - AHB-AP Banked Data Register0 

0x14 BD1 RW - AHB-AP Banked Data Register] 

0x18 BD2 RW - AHB-AP Banked Data Register2 

Qx1C BD3 RW - AHB-AP Banked Data Register3 

0xF8 DBGDRAR RO 0xE00FF003 AHB-AP ROM Address Register 

QxFC IDR RO 0x24770011 AHB-AP Identification Register 


a. The offset given in this table is relative to the location of the AHB-AP in the DAP memory space. This 
space is only visible from the access port. It is not part of the processor memory map. 


The following sections describe the AHB-AP registers whose implementation is specific to this 
processor. Other registers are described in the CoreSight Components Technical Reference 
Manual. 


AHB-AP Control and Status Word Register, CSW 
The CSW characteristics are: 
Purpose Configures and controls transfers through the AHB interface. 


Usage constraints There are no usage constraints. 
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Configurations This register is available in all processor configurations. 
Attributes See the register summary in Table 7-5 on page 7-6. 


Figure 7-2 shows the CSW bit assignments. 


31302928 262524 : : 12 11 8765432 0; 


qe Hprot1 TransInProg cas 
Reserved DbgStatus 


MasterType AddrInc 
Reserved Reserved 


Figure 7-2 CSW bit assignments 
Table 7-6 shows the CSW bit assignments. 


Table 7-6 CSW bit assignments 





Bits Name Function 
[31:30] - Reserved. Read as 0b00. 
[29] MasterType? 0 = core. 

1 = debug. 


This bit must not be changed if a transaction is outstanding. A debugger 
must first check bit [7], TransInProg. 
Reset value = 0b1. 


An implementation can configure this bit to be read only with a value of 1. 
In that case, transactions are always indicated as debug. 

















[28:26] - Reserved, 0b000. 

[25] Hprotl User and Privilege control - HPROT[ 1]. 
Reset value = 0b1. 

[24] - Reserved, 0b1. 

[23:12] - Reserved, 0x000. 

[11:8] Mode Mode of operation bits: 


b0000 = normal download and upload mode 
b0001-b1111 are reserved. 
Reset value = 0b0000. 





[7] TransInProg Transfer in progress. This field indicates if a transfer is in progress on the 
APB master port. 





[6] DbgStatus Indicates the status of the DAPEN port. 
1 = AHB transfers permitted. 
0 = AHB transfers not permitted. 
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Bits 


[5:4] 


Name 


AddrInc 


Debug 


Table 7-6 CSW bit assignments (continued) 


Function 


Auto address increment and pack mode on Read or Write data access. Only 
increments if the current transaction completes with no error. 


Auto address incrementing and packed transfers are not performed on 
access to Banked Data registers 0x10 - 0x1C. The status of these bits is 
ignored in these cases. 


Increments and wraps within a 4-KB address boundary, for example from 
0x1000 to Qx1FFC. If the start is at 0x14A0, then the counter increments to 
Qx1FFC, wraps to 0x1000, then continues incrementing to 0x149C. 


0b00 = auto increment off. 

0b01 = increment single. Single transfer from corresponding byte lane. 
0b10 = increment packed.> 

0b11 = reserved. No transfer. 

Size of address increment is defined by the Size field [2:0]. 

Reset value: 0b00. 





Reserved. 





[2:0] 


Size 


Size of access field: 
b000 = 8 bits 

b001 = 16 bits 

b010 = 32 bits 
b011-111 are reserved. 
Reset value: b000. 


a. When clear, this bit prevents the debugger from setting the C DEBUGEN bit in the Debug Halting 


Control and Status Register, and so prevents the debugger from being able to halt the processor. 


b. See the definition of packed transfers in the ARM Debug Interface v5 Architecture Specification. 
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7.3 About the Flash Patch and Breakpoint Unit (FPB) 


The FPB: 
e implements hardware breakpoints 
e patches code and data from code space to system space. 


A full FPB unit contains: 


. Two literal comparators for matching against literal loads from Code space, and 
remapping to a corresponding area in System space. 


e Six instruction comparators for matching against instruction fetches from Code space, and 
remapping to a corresponding area in System space. Alternatively, you can configure the 
comparators individually to return a Breakpoint Instruction (BKPT) to the processor core 
on a match, to provide hardware breakpoint capability. 


A reduced FPB unit contains: 


. Two instruction comparators. You can configure each comparator individually to return a 
Breakpoint Instruction to the processor on a match, to provide hardware breakpoint 
capability. 


7.3.1 FPB functional description 


The FPB contains both a global enable and individual enables for the eight comparators. If the 
comparison for an entry matches, the address is either 


e remapped to the address set in the remap register plus an offset corresponding to the 
comparator that matched 


e remapped to a BKPT instruction if that feature is enabled. 


The comparison happens dynamically, but the result of the comparison occurs too late to stop 
the original instruction fetch or literal load taking place from the Code space. The processor 
ignores this transaction however, and only the remapped transaction is used. 


Ifan MPU is present, the MPU lookups are performed for the original address, not the remapped 
address. 


You can remove the FPB if no debug is required, or you can reduce the number of breakpoints 
it supports to two. If the FPB supports only two breakpoints then only comparators 0 and 1 are 
used, and the FPB does not support flash patching. 


Note 


e Unaligned literal accesses are not remapped. The original access to the DCode bus takes 
place in this case. 





. Load exclusive accesses can be remapped. However, it is UNPREDICTABLE whether 
they are performed as exclusive accesses or not. 


e Setting the flash patch remap location to a bit-band alias is not supported and results in 
UNPREDICTABLE behavior. 
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FPB programmers model 


Debug 


Table 7-7 shows the FPB registers. Depending on the implementation of your processor, some 
of these registers might not be present. Any register that is configured as not present reads as 


Zero. 


Table 7-7 FPB register summary 

































































Address Name Type Reset Description 

0xE0002000 FP CTRL RW 0x130 FlashPatch Control Register 
0xE0002004 FP REMAP RW - FlashPatch Remap Register 
0xE0002008 FP COMPO RW 1'b0@ FlashPatch Comparator Register0 
0xE000200C FP COMP1 RW 1'bO FlashPatch Comparator Register] 
0xE0002010 FP COMP2 RW 1'bO FlashPatch Comparator Register2 
0xE0002014 FP COMP3 RW 1'b0 FlashPatch Comparator Register3 
0xE0002018 FP COMP4 RW 1'b0 FlashPatch Comparator Register4 
0xE000201C FP COMP5 RW 1'b0 FlashPatch Comparator Register5 
0xE0002020 FP COMP6 RW 1'b0 FlashPatch Comparator Registeró 
0xE0002024 FP COMP7 RW 1'b0 FlashPatch Comparator Register” 
0xE0002FDO PID4 RO 0x04 Peripheral identification registers 
0xE0002FD4  PIDS RO 0x00 

0xE0002FD8  PID6 RO 0x00 

Q@xEQ002FDC PID7 RO 0x00 

0xE0002FEO. PIDO RO 0x03 

0xE0002FE4 PIDI RO 0xB0 

0xE0002FE8 PID2 RO 0x2B 

0xE0002FEC PID3 RO 0x00 

0xE0002FFO CIDO RO 0x0D Component identification registers 
0xE0002FF4 CIDI RO 0xE0 

0xE0002FF8 CID2 RO 0x05 

0xE0002FFC CID3 RO 0xB1 


a. For FP _COMPO to FP_ COMP7, bit 0 is reset to 0. Other bits in these registers are 
not reset. 


All FPB registers are described in the ARMv7-M Architecture Reference Manual. 
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Data Watchpoint and Trace Unit 


This chapter describes the Data Watchpoint and Trace (DWT) unit. It contains the following 
sections: 


e About the DWT on page 8-2 
e DWT functional description on page 8-3 
e DWT Programmers Model on page 8-4. 
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Data Watchpoint and Trace Unit 


8.1 About the DWT 
The DWT is an optional debug unit that provides watchpoints, data tracing, and system profiling 
for the processor. 
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8.2 DWT functional description 
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A full DWT contains four comparators that you can configure as 


e a hardware watchpoint 

. an ETM trigger 

e a PC sampler event trigger 

. a data address sampler event trigger. 


The first comparator, DWT_COMPO, can also compare against the clock cycle counter, 
CYCCNT. You can also use the second comparator, DWT_COMPl, as a data comparator. 


A reduced DWT contains one comparator that you can use as a watchpoint or as a trigger. It does 
not support data matching. 


The DWT if present contains counters for: 
e clock cycles (CYCCNT) 


e folded instructions 
° Load Store Unit (LSU) operations 
e sleep cycles 
. CPI, that is all instruction cycles except for the first cycle 
e interrupt overhead. 
Note 





An event is generated each time a counter overflows. 


You can configure the DWT to generate PC samples at defined intervals, and to generate 
interrupt event information. 


The DWT provides periodic requests for protocol synchronization to the ITM and the TPIU, if 
the your implementation includes the Cortex-M3 TPIU. 
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DWT Programmers Model 


Data Watchpoint and Trace Unit 


Table 8-1 lists the DWT registers. Depending on the implementation of your processor, some of 
these registers might not be present. Any register that is configured as not present reads as zero. 


Table 8-1 DWT register summary 



















































































Address Name Type Reset Description 
0xE0001000 = DWT CTRL RW See 2 Control Register 
0xE0001004 9 DWT CYCCNT RW 0x00000000 Cycle Count Register 
0xE0001008 DWT CPICNT RW - CPI Count Register 
0xE000100C =DWT EXCCNT RW - Exception Overhead Count Register 
0xE0001010 DWT SLEEPCNT RW - Sleep Count Register 
0xE0001014 DWT LSUCNT RW - LSU Count Register 
0xE0001018 DWT FOLDCNT RW - Folded-instruction Count Register 
0xE000101C DWT PCSR RO - Program Counter Sample Register 
QxE0001020 DWT COMPO RW - Comparator Register0 
QxEQ001024 DWT MASKO RW - Mask Register0 
0xE0001028 DWT FUNCTIONO RW 0x00000000 Function Register0 
0xE0001030 DWT COMP! RW - Comparator Register] 
0xE0001034 DWT MASKI RW - Mask Register] 
0xE0001038 DWT FUNCTIONI RW 0x00000000 Function Register| 
QxE0001040 DWT COMP2 RW - Comparator Register2 
0xE0001044 DWT MASK2 RW - Mask Register2 
0xE0001048 DWT FUNCTION2 RW Qx00000000 Function Register2 
QxE0001050 DWT COMP3 RW - Comparator Register3 
QxE0001054 DWT MASK3 RW - Mask Register3 
0xE0001058 DWT FUNCTION3 RW 0x00000000 Function Register3 
0xE0001FDO  PID4 RO 0x04 Peripheral identification registers 
0xE0001FD4 PIDS RO 0x00 
0xE0001FD8 PID6 RO 0x00 
QxEQ001FDC PID7 RO 0x00 
0xE0001FEO PIDO RO 0x02 
0xE0001FE4 PID1 RO 0xB0 
0xE0001FES PID2 RO 0x3B 
0xE0001FEC PID3 RO 0x00 
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Table 8-1 DWT register summary (continued) 











Address Name Type Reset Description 

0xE0001FFO CIDO RO 0x0D Component identification registers 
0xE0001FF4 CIDI RO OxE0 

0xE0001FF8 CID2 RO 0x05 

0xE0001FFC CID3 RO 0xB1 


a. Possible reset values are: 
0x40000000 if four comparators for watchpoints and triggers are present 
0x4F000000 1f four comparators for watchpoints only are present 

0x10000000 if only one comparator is present 
0x1F000000 if one comparator for watchpoints and not triggers is present 
0x00000000 if DWT is not present. 


DWT registers are described in the ARMv7M Architecture Reference Manual. Peripheral 
Identification. Component Identification registers are described in the ARM CoreSight 
Components Technical Reference Manual. 





Note 
e Cycle matching functionality is only available in comparator 0. 
e Data matching functionality is only available in comparator 1. 
e Data value is only sampled for accesses that do not produce an MPU or bus fault. The PC 


is sampled irrespective of any faults. The PC is only sampled for the first address of a 


burst. 


The FUNCTION field in the DWT FUNCTION] register is overridden for comparators 
given by DATAVADDRO and DATAVADDR 1 if DATAVMATCH is also set in 
DWT_FUNCTION!1. The comparators given by DATAVADDRO and DATAVADDRI can 
then only perform address comparator matches for comparator 1 data matches. 


If the data matching functionality is not included during implementation it is not possible 
to set DATAVADDRO, DATAVADDR1, or DATAVMATCH in DWT_FUNCTION1. This 
means that the data matching functionality 1s not available in the implementation. Test the 
availability of data matching by writing and reading the DATAVMATCH bit in 
DWT_FUNCTION1. If this bit cannot be set then data matching is unavailable. 


PC match is not recommended for watchpoints because it stops after the instruction. It 
mainly guards and triggers the ETM. 
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Chapter 9 
Instrumentation Trace Macrocell Unit 


This chapter describes the Instrumentation Trace Macrocell (ITM) unit. It contains the following 
sections: 


e About the ITM on page 9-2 
e ITM functional description on page 9-3 
e ITM programmers model on page 9-4. 
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9.1 About the ITM 
The ITM is a an optional application-driven trace source that supports printf style debugging to 
trace operating system and application events, and generates diagnostic system information. 
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9.2 ITM functional description 
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The ITM generates trace information as packets. Multiple sources can generate packets. If 
multiple sources generate packets at the same time, the ITM arbitrates the order in which 
packets are output. These sources in decreasing order of priority are: 


e Software trace. Software can write directly to ITM stimulus registers to generate packets. 
e Hardware trace. The DWT generates these packets, and the ITM outputs them. 


e Time stamping. Timestamps are generated relative to packets. The ITM contains a 21-bit 
counter to generate the timestamp. The Cortex-M3 clock or the bitclock rate of the Serial 
Wire Viewer (SWV) output clocks the counter. 
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Instrumentation Trace Macrocell Unit 


ITM programmers model 


Table 9-1 shows the ITM registers. Depending on the implementation of your processor, the 
ITM registers might not be present. Any register that 1s configured as not present reads as zero. 


Note 


e You must enable TRCENA of the Debug Exception and Monitor Control Register before 
you program or use the ITM. 





e If the ITM stream requires synchronization packets, you must configure the 
synchronization packet rate in the DWT. 


Table 9-1 ITM register summary 















































Address Name Type Reset Description 
0xE0000000- ITM STIMO- RW - Stimulus Port Registers 0-31 
oxE000007C ITM_STIM31 
0xE0000E00 ITM TER RW 0x00000000 Trace Enable Register 
0xE0000E40 ITM TPR RW 0x00000000 ITM Trace Privilege Register, ITM TPR on page 9-5 
0xE0000E88 ITM TCR RW 0x00000000 Trace Control Register 
0xE0000FDO  PID4 RO 0x00000004 Peripheral Identification registers 
0xE0000FD4 PID5 RO 0x00000000 
0xE0000FD8 PID6 RO 0x00000000 
0xE0000FDC PID7 RO 0x00000000 
0xE0000FEO PIDO RO 0x00000001 
0xE0000FE4 PID1 RO 0x000000B0 
0xE0000FES PID2 RO 0x0000003B 
0xE0000FEC PID3 RO 0x00000000 
0xE0000FFO CIDO RO 0x0000000D Component Identification registers 
0xE0000FF4 CID1 RO 0x000000E0 
0xE0000FF8 CID2 RO 0x00000005 
0xE0000FFC CID3 RO 0x000000B1 
Note 





ITM registers are fully accessible in privileged mode. In user mode, all registers can be read, 

but only the Stimulus Registers and Trace Enable Registers can be written, and only when the 
corresponding Trace Privilege Register bit is set. Invalid user mode writes to the ITM registers 
are discarded. 


The following sections describes the ITM registers whose implementation is specific to this 
processor. Other registers are described in the ARMv7-M Architectural Reference Manual. 
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9.3.1 ITM Trace Privilege Register, ITM_TPR 
The ITM_ TPR characteristics are: 
Purpose Enables an operating system to control the stimulus ports that are 
accessible by user code. 
Usage constraints You can only write to this register in privileged mode. 
Configurations This register is available if the ITM is configured in your implementation. 
Attributes See Table 9-1 on page 9-4. 
Figure 9-1 shows the ITM_TPR bit assignments. 
rem 
PRIVMASK JJ 
Figure 9-1 ITM_TPR bit assignments 
Table 9-2 shows the ITM_TPR bit assignments. 
Table 9-2 ITM_TPR bit assignments 
Bits Name Function 
[31:4] - Reserved. 
[3:0] PRIVMASK Bit mask to enable tracing on ITM stimulus ports: 
bit [0] = stimulus ports [7:0] 
bit [1] = stimulus ports [15:8] 
bit [2] = stimulus ports [23:16] 
bit [3] = stimulus ports [31:24]. 
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Chapter 10 
Embedded Trace Macrocell 


This chapter describes the Embedded Trace Macrocell (ETM). It contains the following sections: 
° About the ETM on page 10-2 

e ETM functional description on page 10-3 

e ETM Programmers model on page 10-9. 
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10.1 About the ETM 


10.1.1 Features 


The ETM is an optional debug component that enables reconstruction of program execution. 
The ETM is designed to be a high-speed, low-power debug tool that only supports instruction 
trace. This ensures that area is minimized, and that gate count is reduced. 


The ETM implements ARM ETM architecture v3.4. See the ARM Embedded Trace Macrocell 
Architecture Specification. 


The ETM traces all 32-bit Thumb instructions as a single instruction. The ETM traces 
instructions following an IT instruction as normal conditional instructions. The decompressor 
does not need to refer to the IT instruction. 


You can use the CoreSight ETM-M3 either with the Cortex-M3 Trace Port Interface Unit 
(M3-TPIU), or as part of a CoreSight system. 


ETM-M3 provides: 

e tracing of 16-bit and 32-bit Thumb instructions 

e four EmbeddedICE watchpoint inputs 

e a Trace Start/Stop block with EmbeddedICE inputs 
e two external inputs 

e a 24-byte FIFO queue. 


See the Embedded Trace Macrocell Architecture Specification for information about: 
. the trace protocol 


e controlling tracing using triggering and filtering resources. 


See the Cortex-M3 Integration and Implementation Manual for information about the macrocell 
signals. 


10.1.2 Configurable options 
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The ETM-M3 macrocell includes the following configuration inputs: 
e the maximum number of external inputs, see External inputs on page 10-6 


e whether the system supports the FIFOFULL mechanism for stalling the processor, see 
Table 10-1 on page 10-4. 


Copyright © 2005-2008, 2010 ARM Limited. All rights reserved. 10-2 
Non-Confidential 


Embedded Trace Macrocell 


10.2 ETM functional description 


Figure 10-1 shows a block diagram of the ETM, and shows how the ETM interfaces to the Trace 
Port Interface Unit (TPIU). 


ETM-M3 
aa 
processor 


Trace Control: 
Counter Cortex-M3 Trace port 
Start/Stop block TPIU or and | 
Trigger generation Coresight SerialWire 
Programming interface system trace outputs 





Figure 10-1 ETM block diagram 


The Cortex-M3 system can perform low-bandwidth data tracing using the Data Watchpoint and 
Trace (DWT) and Instruction Trace Macrocell (ITM) components. 


The ETM trace output is compatible with the AMBA Trace Bus (ATB) protocol, irrespective of 
the configuration of the trace port size and trace port mode within the ETM programmers model. 
The TPIU exports trace information from the processor. An implementation can replace the 
TPIU with other CoreSight trace components. 


For more information see: 

e Chapter 8 Data Watchpoint and Trace Unit 

e Chapter 9 Instrumentation Trace Macrocell Unit 

° Chapter 11 Trace Port Interface Unit 

e Embedded Trace Macrocell Architecture Specification. 


The ETM provides a trace ID register for systems that use multiple trace sources. You must 
configure this register even 1f only a single trace source is in use. 


The following sections provide information on features of the ETM: 


° Resources 
. Periodic synchronization on page 10-6 
e Data and instruction address compare resources on page 10-6 


e External inputs on page 10-6 
e Start/stop block on page 10-6 
° Triggering on page 10-6 

. Interfaces on page 10-7 

° Operation on page 10-8. 


10.2.1 Resources 


Because the ETM does not generate data trace information, the lower bandwidth reduces the 
requirement for complex triggering capabilities. This means that the ETM only includes a small 
sub-set of the possible resources allowed by the ETM architecture. 
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Table 10-1 Cortex-M3 resources 




































































Feature Present on ETM-M3 
Architecture version ETMv3.4 
Address comparator pairs 0 

Data comparators 0 
Context ID comparators 0 
Memory Map Decoders (MMDs) 0 
Counters 0 
Sequencer No 
Start/stop block Yes 
Embedded ICE comparators 4 
External inputs 2 
External outputs 0 
Extended external inputs 0 
Extended external input selectors 0 
FIFOFULL Yes 
FIFOFULL level setting Yes 
Branch broadcasting Yes 
ASIC Control Register No 
Data suppression No 
Software access to registers Yes 
Readable registers Yes 
FIFO size 24 bytes 
Minimum port size 8 bits 
Maximum port size 8 bits 





Normal port mode 





Normal half-rate clocking, 1:1 


Yes - asynchronous 





Demux port mode 











Demux half-rate clocking, 1:2 No 
Mux port mode, 2:1 No 
1:4 port mode No 





Dynamic port mode, including stalling 


No. Supported by asynchronous port mode. 
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Table 10-1 Cortex-M3 resources (continued) 








Feature Present on ETM-M3 
Load PC first No 
Fetch comparisons No 
Load data traced No 


Resource identification encoding 


You configure the trace enable event and trigger event using the same mechanism. For each 
event, a 17-bit register is used to define the event. This register provides: 


e Resource A, bits [6:0] 
° Resource B, bits [13:7] 
° a Boolean function, bits [16:14]. 


Table 10-2 shows the encodings used for the Boolean function. 


Table 10-2 Boolean function encoding for events 


Encoding Function 























b000 A 
b001 NOT(A) 

b010 A ANDB 

b011 NOT(A) AND B 

b100 NOT(A) AND NOT (B) 
b101 A ORB 

b110 NOT (A) OR B 

b111 NOT (A) OR NOT (B) 


Table 10-3 shows the encodings used for Resource identification. 


Resource type? 


Table 10-3 Resource identification encoding 


Index range? 


Description of resource type 














b010 0-3 DWT Comparator inputs (0-3) 
b100 0 Counter 1 at zero 

b101 15 Trace Start/Stop resource 
b110 0-1 ExtIn (0-1) 

b110 15 HardWired (always True) 


a. For Resource A, bits [6:4]. For Resource B, bits [13:11] 
b. For Resource A, bits [3:0]. For Resource B, bits [10:7]. 
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10.2.2 Periodic synchronization 


The ETM uses a fixed synchronization packet generation frequency of every 1024 bytes of 
trace. 


10.2.3 Data and instruction address compare resources 


10.2.4 External inputs 


The DWT provides four address comparators on the data bus that provide debug functionality. 
Within the DWT unit, you can specify the functions triggered by a match, and one of these 
functions is to generate an ETM match input. These inputs are presented to the ETM as 
Embedded In Circuit Emulator (ICE) comparator inputs. 


A single DWT resource can trigger an ETM event and also generate instrumentation trace 
directly from the same event. 


You can configure the four DWT comparators individually to compare with the address of the 
current executing instruction to permit the ETM access to an instruction address compare 
resource. These inputs are presented to the ETM as Embedded ICE comparator inputs. The 
DWT provides either 1 or 4 comparators, depending on the implementation of the processor. 


Note 


Using a DWT comparator as an instruction address comparator reduces the number of available 
data address comparisons. 





See Chapter 8 Data Watchpoint and Trace Unit for more information about the DWT unit. 


Two external inputs, ETMEXTIN[1:0], enable additional components to generate trigger and 
enable signals for the ETM. 


10.2.5 Start/stop block 


10.2.6 Triggering 
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The start/stop block provides a single-bit resource that can be used as an input to other parts of 
the resource logic, including the trace enable logic. The start/stop block can only be controlled 
by using the EmbeddedICE inputs to the ETM. The DWT controls these inputs. 


The start/stop block is set to the start state if any of the EmbeddedICE watchpoint inputs 
selected as start resources in ETMTESSEICR go HIGH. The start/stop block is set to the stop 
state if any of the EmbeddedICE watchpoint inputs selected as stop resources in 
ETMTESSEICR go LOW. 


If bit [25] of ETMTECRI is 1, tracing will only be enabled when the start/stop block is in the 
Start state. 


Tracing is also only enabled when the result of evaluating the Trace Enable Event is TRUE. This 
event can be set to always be TRUE by programming a value of 0x6F to ETMTEEVR. For more 
information see the Embedded Trace Macrocell Architecture Specification. 


The ETM provides a trigger resource that can be used to identify a point within a trace run. The 
generation of a trigger does not affect the tracing in any way, but the trigger will be output in the 
trace stream, and can also be passed to other trace components or used to halt the processor. An 
external trace port analyzer can use the trigger to determine when to start and stop capture of 
trace. 
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The ETM-M3 has the following external interfaces: 


ATB A 32-bit Advanced Trace Bus provides trace output from the macrocell. See the 
AMBA 3 ATB Protocol Specification for more information about this interface. 

APB An Advanced Peripheral Bus provides the control interface for the macrocell. See 
the AMBA 3 APB Protocol Specification for more information about this 
interface. 

CTI Your implementation can provide a Cross Trigger Interface to manage the 


interconnection of trigger and control signals between the processor core, ETM, 
and TPIU. The implementation of your Cortex-M3 processor determines which 
ETM functions are visible to the CTI. 


Recommended CTI connections 


Table 10-4 and Table 10-5 show the recommended CTI connections for Cortex-M3 systems. 


Note 





These tables show the ARM standard connections, but the actual connections are 
implementation-defined. Check the documentation from the supplier of your device for any 


changes to these 


Trigger bit Source signal 


connections. 


Source device 


Table 10-4 Input connections 


Comments 
































[7] ETMTRIGOUT ETM Recommended if ETM is present. 
[6] ETMTRIGGER[2] DWT Recommended. 
[5] ETMTRIGGER[1] DWT Recommended. 
[4] ETMTRIGGER[0] DWT Recommended. 
[3] ACQCOMP ETB Recommended if an Embedded Trace Buffer (ETB) is present. 
If multiple cores share a single ETB, you must only connect 
[2] FULL ETB to the CTI of one of the cores. 
[1] User Defined - - 
[0] DBGACK Core Compulsory. 
Table 10-5 Trigger output connections 
Trigger bit ere eral Comments 
[7] User defined - - 
[6] User defined - - 
[5] ETMEXTIN[1] ETM Compulsory if ETM is present. 
[4] ETMEXTIN[0] ETM Compulsory if ETM is present. 
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Table 10-5 Trigger output connections (continued) 











.. Destination Destination 
Trigger bit . i Comments 
signal device 
[3] INTISR[y] NVIC Recommended if an ETB is present. If multiple cores share a 
single ETB, you must only connect to the CTI of one of the cores. 
[2] INTISR[x] NVIC Compulsory. Any interrupt can be used. 
[1] User defined - - 
[0] EDBGRQ Core Compulsory. 


10.2.8 Operation 
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ETM-M3 implements version 3.4 of the ARM Embedded Trace Macrocell protocol. See ETM 
Programmers model on page 10-9 and the Embedded Trace Macrocell Architecture 
Specification for more information. 
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10.3.1 
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ETM Programmers model 


This section describes the mechanisms for programming the registers used to set up the trace 
and triggering facilities of the macrocell. The programmers model enables you to use the ETM 
registers to control the macrocell. 


Modes of operation and execution 


When the ETM is powered up or reset, you must program all of the registers that do not have an 
architected reset state before you enable tracing. If you do not do so, the trace results are 
UNPREDICTABLE. 


When programming the ETM registers you must enable all the changes at the same time. To 
achieve this, the Programming bit in ETMCR should be used. See Main Control Register, 
ETMCR on page 10-10 


When the Programming bit is set to 0 you must not write to registers other than ETMCR, 
because this can lead to UNPREDICTABLE behavior. 


When setting the Programming bit, you must not change any other bits of ETMCR. You must 
only change the value of bits other than the Programming bit of ETMCR when bit [1] of ETMSR 
is set to 1. ARM recommends that you use a read-modify-write procedure when changing 
ETMCR. 


10.3.2 Register summary 


Table 10-6 shows the ETM registers. 


Table 10-6 ETM registers 












































Address Name Reset Type Description 

QxE0041000 = ETMCR 0x00000411 RW Main Control Register, ETMCR on page 10-10 

0xE0041004 ETMCCR 8C800000 RO Configuration Code Register, ETMCCR on page 10-13 

QxE0041008 ETMTRIGGER - RW See ARM Embedded Trace Macrocell Architecture Specification. 

0xE0041010 ETMSR - RW See ARM Embedded Trace Macrocell Architecture Specification. 

0xE0041014 ETMSCR 0x00020D09 RO System Configuration Register, ETMSCR on page 10-14 

QxEQ041020 9 ETMTEEVR - RW See ARM Embedded Trace Macrocell Architecture Specification. 

0xE0041024 ETMTECRI - RW TraceEnable Control 1 Register, ETMTECRI on page 10-15 

Q@xEQ041028 ETMFFLR - RW See ARM Embedded Trace Macrocell Architecture Specification. 

0xE0041180 ETMSYNCFR 0x00000400 RO See ARM Embedded Trace Macrocell Architecture Specification. 

QxEQ0411E4 ETMIDR 0x4114F242 RO ID Register, ETMIDR on page 10-16 

0xE0041188 ETMCCER 0x00141800 RO Configuration Code Extension Register, ETMCCER on page 10-17 

QxEQ0411F@ ETMTESSEICR - RW TraceEnable Start/Stop EmbeddedICE Control Register, 
ETMTESSEICR on page 10-18 

QxE0041200 = ETMTRACEIDR 0x00000000 RW See ARM Embedded Trace Macrocell Architecture Specification. 

QxE0041208 ETMIDR2 0x00000000 RO See ARM Embedded Trace Macrocell Architecture Specification. 

0xE0041314 ETMPDSR 0x00000001 RO Device Power-Down Status Register, ETMPDSR on page 10-18 
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Table 10-6 ETM registers (continued) 




































































Address Name Reset Type Description 

0xE0041EE0 ITMISCIN - RO Integration Test Miscellaneous Inputs, ITMISCIN on page 10-19 
0xE0041EE8 ITTRIGOUT - WO Integration Test Trigger Out, ITTRIGOUT on page 10-20 
0xE0041EFð ETM ITATBCTR2 - RO ETM Integration Test ATB Control 2, ETM _ITATBCTR2 on page 10-20 
0xE0041EF8 ETM ITATBCTRO - WO ETM Integration Test ATB Control 0, ETM_ITATBCTRO on page 10-21 
0xE0041F00  ETMITCTRL 0x00000000 RW See ARM Embedded Trace Macrocell Architecture Specification. 
Q@xEQ041FAQ = ETMCLAIMSET - RW See ARM Embedded Trace Macrocell Architecture Specification. 
QxEQ041FA4 ETMCLAIMCLR - RW See ARM Embedded Trace Macrocell Architecture Specification. 
QxEQ041FB@ ETMLAR - RW See ARM Embedded Trace Macrocell Architecture Specification. 
0xE0041FB4 ETMLSR - RO See ARM Embedded Trace Macrocell Architecture Specification. 
QxEQ041FB8 ETMAUTHSTATUS - RO See ARM Embedded Trace Macrocell Architecture Specification. 
Q@xEQ041FCC ETMDEVTYPE 0x00000013 RO See ARM Embedded Trace Macrocell Architecture Specification. 
0xE0041FD0 ETMPIDR4 0x00000004 RO See ARM Embedded Trace Macrocell Architecture Specification. 
0xE0041FD4  ETMPIDRS 0x00000000 RO 

0xE0041FD8 ETMPIDR6 0x00000000 RO 

Q@xEQ041FDC ETMPIDR7 0x00000000 RO 

QxEQ041FEQ ETMPIDRO 0x00000024 RO 

QxEQ041FE4 ETMPIDRI 0x000000B9 RO 

0xE0041FE8 ETMPIDR2 0x0000002B RO 

0xE0041FEC” ETMPIDR3 0x00000000 RO 

QxEQ041FF@ ETMCIDRO 0x0000000D RO See ARM Embedded Trace Macrocell Architecture Specification. 
QxEQ041FF4 ETMCIDRI 0x00000090 RO 

0xE0041FF8 ETMCIDR2 0x00000005 RO 

0xE0041FFC” ETMCIDR3 0x000000B1 RO 


10.3.3 Main Control Register, ETMCR 


The ETMCR characteristics are: 


Purpose 


Usage constraints 


Configurations 


Controls general operation ofthe ETM, such as whether tracing 1s enabled. 


There are no usage constraints. 


This register is only available if the processor is configured to use the 
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Attributes 


ETM. 


See the ETM register summary in Table 10-6 on page 10-9. 


Figure 10-2 on page 10-11 shows the ETMCR bit assignments. 


Copyright © 2005-2008, 2010 ARM Limited. All rights reserved. 


10-10 
Non-Confidential 


31 


Embedded Trace Macrocell 


TT TT TNT 876 43 10 


Rasa 





| ETM 
Port ze — power down 
Reserved Reserved 
Port mode[1:0] Port size[2:0] 
Reserved Stall processor (FIFOFULL) 


Port mode[2] Branch output 
Reserved Debug request control 
ETM port select (ETMEN) ETM programming 


Figure 10-2 ETMCR bit assignments 


Table 10-7 shows the ETMCR bit assignments. 


Table 10-7 ETMCR bit assignments 


























Bits Name Function 
[31:22] - RAZ 
[21] Port size[3] This bit is implemented but has no function. 
An ETM reset sets this bit to 0. 
[20:18] - Reserved 
[17:16] Port mode [1:0] These bits are implemented but have no function. 
An ETM reset sets these bits to 0. 
[15:14] - Reserved 
[13] Port mode[2] This bit is implemented but has no function. 
An ETM reset sets this bit to 0. 
[12] - Reserved 
[11] ETM port selection This bit can be used to control other trace components in an implementation. The possible values 
are: 
0 ETMEN is LOW. 
1 ETMEN is HIGH. 
This bit must be set by the trace software tools to ensure that trace output is enabled from this 
ETM. 
An ETM reset sets this bit to 0. 
[10] ETM programming This bit must be set to 1 at the start of the ETM programming sequence. Tracing is prevented while 


this bit is set to 1. 
On an ETM reset this bit is set to b1. 





Debug request control When set to 1 and the trigger event occurs, the DBGRQ output is asserted until DBGACK is 
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observed. This enables the ARM processor to be forced into Debug state. 
An ETM reset sets this bit to 0. 
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Table 10-7 ETMCR bit assignments (continued) 











Bits Name Function 

[S] Branch output When set to 1 all branch addresses are output, even if the branch was because of a direct branch 
instruction. Setting this bit enables reconstruction of the program flow without having access to 
the memory image of the code being executed. 

When this bit is set to 1, more trace data is generated, and this may affect the performance of the 
trace system. Information about the execution of a branch is traced regardless of the state of this 
bit. 

An ETM reset sets this bit to 0. 

[7] Stall processor The FIFOFULL output can be used to stall the processor to prevent overflow. The FIFOFULL 
output is only enabled when the stall processor bit is set to 1. When the bit is 0 the FIFOFULL 
output remains LOW at all times and the FIFO overflows if there are too many trace packets. Trace 
resumes without corruption once the FIFO has drained, if overflow does occur. 

An ETM reset sets this bit to 0. 
For information about the interaction of this bit with the ETMFFLR register see the Embedded 
Trace Macrocell Architecture Specification. 

[6:4] Port size [2:0] The ETM-M3 has no influence over the external pins used for trace. These bits are implemented 
but not used. 

On an ETM reset these bits reset to 0b001. 

[3:1] - Reserved 





ETM power down 
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This bit can be used by an implementation to control if the ETM is in a low power state. This bit 
must be cleared by the trace software tools at the beginning of a debug session. 


When this bit is set to 1, writes to some registers and fields might be ignored. You can always write 
to the following registers and fields: 


e ETMCR bit [0] 

e ETMLAR 

e ETMCLAIMSET register 

e ETMCLAIMCLR register. 

When the ETMCR is written with this bit set to 1, bits other than bit [0] might be ignored. 
On an ETM reset this bit is set to 1. 
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10.3.4 Configuration Code Register, ETMCCR 
The ETM Configuration Code Register characteristics are: 
Purpose Enables software to read the implementation-specific configuration of the 
ETM. 
Usage constraints There are no usage constraints. 
Configurations This register is only available if the processor is configured to use the 
ETM. 
Attributes See the ETM register summary in Table 10-6 on page 10-9. 
Figure 10-3 shows the ETMCCR bit assignments. 
T TTT T1111 101 30 2827 2625242322 2019 171615 1312 8 7 4 3 o 
ETM ID 
register since Number of data 
present value comparators 
Coprocessor and Number of memory Number of address 
memory mapped map decoders comparator pairs 
access supported Number of counters 
Trace start/stop Sequencer present 
block present Number of external inputs 
Number of Context ID Number of external outputs 
comparators FIFOFULL logic present 
Figure 10-3 ETMCCR bit assignments 
Table 10-8 shows the ETMCCR bit assignments. 
Table 10-8 ETMCCR bit assignments 
Bits Name Function 
[31] ETM ID register present The value of this bit is 1, indicating that the ETMIDR, register 0x79, is present and 
defines the ETM architecture version in use. 
[30:28]  - Reserved. 
[27] Coprocessor and memory access The value of this bit 1s 1, indicating that memory-mapped access to registers 1s 
supported. 
[26] Trace start/stop block present The value of this bit is 1, indicating that the Trace start/stop block is present. 
[25:24] Number of Context ID comparators The value of these bits is b00, indicating that Context ID comparators are not 
implemented. 
[23] FIFOFULL logic present The value of this bit is 1, indicating that FIFOFULL logic is present in the ETM. 
To use FIFOFULL the system must also support the function, as indicated by bit 
[8] of ETMSCR, see System Configuration Register, ETMSCR on page 10-14. 
[22:20] | Number of external outputs The value of these bits is b000, indicating that no external outputs are supported. 
[19:17] | Number of external inputs The value of these bits is between b000 and b010, indicating the number of external 
inputs, from 0 to 2, implemented in the system. 
[16] Sequencer present The value of this bit is 0, indicating that the sequencer is not implemented. 
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Table 10-8 ETMCCR bit assignments (continued) 


Bits Name Function 


[15:13] Number of counters The value of these bits is b000, indicating counters are not implemented. 





[12:8] Number of memory map decoders The value of these bits is b00000, indicating that memory map decoder inputs are 
not implemented. 








[7:4] Number of data value comparators The value of these bits is b0000, indicating that data value comparators are not 
implemented. 

[3:0] Number of address comparator pairs The value of these bits is b0000, indicating that address comparator pairs are not 
implemented. 


10.3.5 System Configuration Register, ETMSCR 
The ETMSCR characteristics are: 


Purpose Shows the ETM features supported by the implementation of the ETM 
macrocell. 


Usage constraints There are no usage constraints. 


Configurations This register is only available if the processor is configured to use the 
ETM. 
Attributes See the register summary in Table 10-6 on page 10-9. 


Figure 10-4 shows the ETMSCR bit assignments. 


31 | : = 1817161514 1211109 8 7 4.3 2 


No fetch O = 
Reserved Maximum 


(N -1), where N = Number of supported processors port size[2:0] 
Port mode supported Reserved, 
Port size supported reads as 1 
Maximum port size[3] Reserved, 

FIFOFULL supported reads as 0x0 


Figure 10-4 ETMSCR bit assignments 
Table 10-9 shows the ETMSCR bit assignments. 


Table 10-9 ETMSCR bit assignments 














Bits Name Function 

[31:18] - Reserved. 

[17] No Fetch comparisons The value of this bit is 1, indicating that fetch comparisons are not implemented. 

[16:15] - Reserved. 

[14:12] (N-1) These bits give the number of supported processors minus 1. The value of these bits is b000, 
indicating that there is only one processor connected. 

[11] Port mode supported This bit reads as 1 if the currently selected port mode is supported. This has no effect on the 
TPIU trace port. 
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Table 10-9 ETMSCR bit assignments (continued) 











Bits Name Function 

[10] Port size supported This bit reads as 1 if the currently selected port size is supported. This has no effect on the 
TPIU trace port. 

[9] Maximum port size [3] Maximum ETM port size bit [3]. This bit is used in conjunction with bits [2:0]. Its value is 0. 
This has no effect on the TPIU trace port. 

[8] FIFOFULL supported The value of this bit is 1, indicating that FIFOFULL is supported. This bit is used in 
conjunction with bit [23] of the ETMCCR. 

[7:4] - Reserved, Read-As-Zero. 





[3] i 


Reserved, Read-As-One. 





[2:0] Maximum port size [2:0] 


Maximum ETM port size bits [2:0]. These bits are used in conjunction with bit [9]. The value 
of these bits is b001. 


10.3.6 TraceEnable Control 1 Register, ETMTECR1 


The ETMTECRI characteristics are: 


Purpose 


Enables the start/stop logic used for trace enable. 


Usage constraints There are no usage constraints. 


Configurations This register is only available if the processor is configured to use the 
ETM. 
Attributes See the register summary in Table 10-6 on page 10-9. 


Figure 10-5 shows the ETMTECR1 bit assignments. 


31 


26 25 24 o 


Trace control io, 


Figure 10-5 ETMTECR1 bit assignments 


Table 10-10 shows the ETMTECR 1 bit assignments. 


Table 10-10 ETMTECR1 bit assignments 





Bits Name Function 
[31:26]  - Reserved. 
[25] Trace control enable Trace start/stop enable. The possible values of this bit are: 
0 Tracing 1s unaffected by the trace start/stop logic. 
1 Tracing 1s controlled by the trace on and off addresses configured for the trace 


start/stop logic. 


The trace start/stop resource, resource 0x5F, is unaffected by the value of this bit. 





[24:0] - Reserved. 
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10.3.7 ID Register, ETMIDR 
The ETMIDR characteristics are: 
Purpose Holds the ETM architecture variant, and defines the programmers model 
for the ETM. 
Usage constraints There are no usage constraints. 
Configurations This register is only available if the processor is configured to use the 
ETM. 
Attributes See the register summary in Table 10-6 on page 10-9. 
Figure 10-6 shows the ETMIDR bit assignments. 
31 24 23 21 20 19 18 17 1615 12: 11 
Reserved =— Processor mee Y Minor 
family 
E eet architecture Implementation 
Implements alternative branch packet encoding version number revision 
Support for Security Extensions Load PC first 
Support for 32-bit Thumb instructions Reserved 
Figure 10-6 ETMIDR bit assignments 
Table 10-11 shows the ETMIDR bit assignments. 
Table 10-11 ETMIDR bit assignments 
Bits Name Function 
[31:24] Implementor code These bits identify ARM as the implementor of the processor. The value of these bits is 
01000001. 
[23:21] - Reserved. 
[20] Branch packet encoding The value of this bit is 1, indicating that alternative branch packet encoding is implemented. 
[19] Security Extensions The value of this bit is 0, indicating that the ETM behaves as if the processor is in Secure 
support state at all times. 
[18] 32-bit Thumb instruction The value of this bit is 1, indicating that a 32-bit Thumb instruction is traced as a single 
tracing instruction. 
[17] - Reserved. 
[16] Load PC first The value of this bit is 0, indicating that data tracing is not supported. 
[15:12] | Processor family The value of these bits is b1111, indicating that the processor family is not identified in this 
register. 
[11:8] Major ETM architecture The value of these bits is b0010, indicating major architecture version number 3, ETMv3. 
version 
[7:4] Minor ETM architecture The value of these bits is b0100, indicating minor architecture version number 4. 
version 
[3:0] Implementation revision The value of these bits is b0010, indicating implementation revision, 2. 
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10.3.8 Configuration Code Extension Register, ETMCCER 
The ETMCCER characteristics are: 


Purpose Holds ETM configuration information additional to that in the ETMCCR. 
See Configuration Code Register, ETMCCR on page 10-13. 


Usage constraints There are no usage constraints. 


Configurations This register is only available if the processor is configured to use the 
ETM. 
Attributes See the register summary in Table 10-6 on page 10-9. 


Figure 10-7 shows the ETMCCER bit assignments. 


31 : ` 22212019 1615 131211 10 7 32 O. 


Reserved, RAZ Extended external 
input bus size 


EmbeddedICE Behavior Control | 
Register implemented 
Trace Start/Stop block uses 
EmbeddedICE inputs 


Number of EmbeddedICE watchpoint inputs 
Number of Instrumentation resources 

Set if data address comparison is not supported 
Set to 1 if all registers are readable 

Number of extended external input selectors 


Figure 10-7 ETMCCER bit assignments 
Table 10-12 shows the ETMCCER bit assignments. 


Table 10-12 ETMCCER bit assignments 








Bits Name Function 

[31:22] - Reserved. Read-As-Zero. 

[21] EmbeddedICE behavior The value of this bit is 0, indicating that the ETMEIBCR is not implemented. For more 
control implemented information on EmbeddedICE behavior see the Embedded Trace Macrocell Architecture 

Specification. 

[20] Trace Start/Stop block uses The value of this bit is 1, indicating that the Trace Start/Stop block uses the EmbeddedICE 
EmbeddedICE watchpoint watchpoint inputs. 
inputs 





[19:16] |EmbeddedICE watchpoint The value of these bits is b0100, indicating that the number of EmbeddedICE watchpoint 

















inputs inputs implemented is four. These inputs come from the DWT. 

[15:13] Instrumentation resources The value of these bits is b000, indicating that no Instrumentation resources are supported. 

[12] Data address comparisons The value of this bit is 1, indicating that data address comparisons are not supported. 

[11] Readable registers The value of this bit is 1, indicating that all registers are readable. 

[10:3] Extended external input bus The value of these bits 1s 0, indicating that the extended external input bus is not 

implemented. 

[2:0] Extended external input The value of these bits is 0, indicating that extended external input selectors are not 

selectors implemented. 
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10.3.9 TraceEnable Start/Stop EmbeddedIiCE Control Register, ETMTESSEICR 


The ETMTESSEICR characteristics are: 


Purpose Specifies the EmbeddedICE watchpoint comparator inputs that are used to 
control the start/stop resource. 


Usage constraints There are no usage constraints. 


Configurations This register is only available if the processor is configured to use the 
ETM. 
Attributes See the register summary in Table 10-6 on page 10-9. 


Figure 10-8 shows the ETMTESSEICR bit assignments. 


31 : 20 19 18 17 16 15 : 43210 
Reserved, RAZ P Reserved, RAZ TU 

4 ee ed 2 1 ES 2 2 1 

Stop resource Eo ar bits Start resource ae bits 


Figure 10-8 ETMTESSEICR bit assignments 
Table 10-13 shows the ETMTESSEICR bit assignments. 


Table 10-13 ETMTESSEICR bit assignments 











Bits Name Function 

[31:20]  - Reserved, Read-as-zero. 

[19:16] Stop resource selection Setting any of these bits to 1 selects the corresponding EmbeddedICE watchpoint input as a 
TraceEnable stop resource. Bit [16] corresponds to input 1, bit [17] corresponds to input 2, 
bit [18] corresponds to input 3, and bit [19] corresponds to input 4. 

[15:4] - Reserved, Read-As-Zero. 

[3:0] Start resource selection Setting any of these bits to 1 selects the corresponding EmbeddedICE watchpoint input as a 


TraceEnable start resource. Bit [0] corresponds to input 1, bit [1] corresponds to input 2, bit [2] 
corresponds to input 3, and bit [3] corresponds to input 4. 


10.3.10 Device Power-Down Status Register, ETMPDSR 
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The ETMPDSR characteristics are: 

Purpose Indicates the power-down status of the ETM. 

Usage constraints There are no usage constraints. 

Configurations This register is only available if the processor is configured to use an ETM. 
Attributes See the register summary in Table 10-6 on page 10-9 


Figure 10-9 on page 10-19 shows the ETMPDSR bit assignments. 
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31 | | | | | | | 1.0 


Reserved, RAZ i 


ETM powered i 


Figure 10-9 ETMPDSR bit assignments 
Table 10-14 shows the ETMPDSR bit assignments. 


Table 10-14 ETMPDSR bit assignments 





Bits Name Function 
[31:1] - Reserved, Read-As-Zero. 
[0] ETM powered up The value of this bit indicates whether you can access the ETM Trace Registers. The value of this bit is 


always 1, indicating that the ETM Trace Registers can be accessed. 


10.3.11 Integration Test Miscellaneous Inputs, ITMISCIN 
The ITMISCIN characteristics are: 
Purpose Integration test. 


Usage constraints There are no usage constraints. 


Configurations This register is only available if the processor is configured to use the 
ETM. 
Attributes See the register summary in Table 10-6 on page 10-9. 


Figure 10-10 shows the ITMISCIN bit assignments. 


31 | | | | | 1 43210 


MN 
COREHALT | 
Reserved 
EXTIN[1:0] 


Figure 10-10 ITMISCIN bit assignments 


al 


Table 10-15 shows the ITMISCIN bit assignments. 


Table 10-15 ITMISCIN bit assignments 








Bits Name Function 
[31:5] - Reserved. 
[4] COREHALT A read of this bit returns the value of the COREHALT input pin. 
[3:2] - Reserved. 





[1:0] EXTIN[1:0] A read of these bits returns the value of the EXTIN[1:0] input pins. 
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10.3.12 Integration Test Trigger Out, ITTRIGOUT 
The ITMISCIN characteristics are: 
Purpose Integration test. 


Usage constraints You must set bit [0] of ETMITCTRL to use this register. 


Configurations This register is only available if the processor is configured to use the 
ETM. 
Attributes See the register summary in Table 10-6 on page 10-9 


Figure 10-11 shows the ITTRIGOUT bit assignments. 


31 | e ; | : | o 10 
e 
TRIGGER output value _ 


Figure 10-11 ITTRIGOUT bit assignments 


Table 10-16 shows the ITTRIGOUT bit assignments. 


Table 10-16 ITTRIGOUT bit assignments 





Bits Name Function 
[31:1] - Reserved 
[0] TRIGGER output value A write to this bit sets the TRIGGER output. 


10.3.13 ETM Integration Test ATB Control 2, ETM_ITATBCTR2 
The ETM_ITATBCTR2 characteristics are: 
Purpose Integration test. 


Usage constraints You must set bit [0] of ETMITCTRL to use this register. 


Configurations This register is only available if the processor is configured to use the 
ETM. 
Attributes See the register summary in Table 10-6 on page 10-9 


Figure 10-12 shows the ETM_ITATBCTR2 bit assignments. 
e O O 
ATREADY input value _ 


Figure 10-12 ETM_ITATBCTR2 bit assignments 
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Table 10-17 shows the ETM_ITATBCTR2 bit assignments. 


Table 10-17 ETM_ITATBCTR2 bit assignments 





Bits Name Function 
[31:1] - Reserved 
[0] ATREADY input value A read of this bit returns the value of the ETM ATREADY input. 


10.3.14 ETM Integration Test ATB Control 0, ETM_ITATBCTRO 
The ETM_ITATBCTRO characteristics are: 
Purpose Integration test. 


Usage constraints You must set bit [0] of ETMITCTRL to use this register. 


Configurations This register is only available if the processor is configured to use the 
ETM. 
Attributes See the register summary in Table 10-6 on page 10-9. 


Figure 10-13 shows the ETM ITATBCTRO bit assignments. 
rent O O 
ATVALID output value _ 


Figure 10-13 ETM_ITATBCTRO bit assignments 


Table 10-18 shows the ETM ITATBCTRO bit assignments. 


Table 10-18 ETM_ITATBCTRO bit assignments 





Bits Name Function 

[31:1] - Reserved 

[0] ATVALID output value A write to this bit sets the value of the ETM ATVALID output. 
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Trace Port Interface Unit 
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This chapter describes the Cortex-M3 TPIU, the Trace Port Interface Unit that is specific to the 
Cortex-M3 processor. It contains the following sections: 


° About the Cortex-M3 TPIU on page 11-2 
e TPIU functional description on page 11-3 
. TPIU programmers model on page 11-5. 
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11.1 About the Cortex-M3 TPIU 
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The Cortex-M3 TPIU is an optional component that acts as a bridge between the on-chip trace 
data from the Embedded Trace Macrocell (ETM) and the Instrumentation Trace Macrocell 
(ITM), with separate IDs, to a data stream. The TPIU encapsulates IDs where required, and the 
data stream is then captured by a Trace Port Analyzer (TPA). 


The Cortex-M3 TPIU is specially designed for low-cost debug. It is a special version of the 
CoreSight TPIU. Your implementation can replace the Cortex-M3 TPIU with other CoreSight 
components if your implementation requires the additional features of the CoreSight TPIU. 


In this chapter, the term TPIU refers to the Cortex-M3 TPIU. For information about the 
CoreSight TPIU, see the ARM CoreSight Components Technical Reference Manual. 
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11.2  TPIU functional description 


There are two configurations of the TPIU: 
e A configuration that supports ITM debug trace. 
e A configuration that supports both ITM and ETM debug trace. 


If your implementation requires no trace support then the TPIU might not be present. 


Note 


If your Cortex-M3 system uses the optional ETM component, the TPIU configuration supports 
both ITM and ETM debug trace. See Chapter 10 Embedded Trace Macrocell. 





11.2.1 TPIU block diagrams 


11.2.2 TPIU Formatter 
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Figure 11-1 shows the component layout of the TPIU for both configurations. 


CLK Domain TRACECLKIN Domain 


TRACECLKIN 


t ETM ATB Slave Port t ATB 


Interface 
TRACECLK 


Trace Out 
(serializer) 


Formatter 
TRACEDATA [3:0] 


ATB 
mioniage TRACESWO 


ITM ATB Slave Port 


APB 
Interface 


APB Slave Port 


t Optional component 


Figure 11-1 TPIU block diagram 


The formatter inserts source ID signals into the data packet stream so that trace data can be 
re-associated with its trace source. The formatter is always active when the Trace Port Mode is 
active. 


The formatting protocol is described in the CoreSight Architecture Specification. You must 
enable synchronization packets in the DWT to provide synchronization for the formatter. 


When the formatter is enabled, the NULL ID and bytes of 0x00 data can be inserted 1f there is 
no data to output after a frame has been started. Once the frame has been completed, full 
synchronization packets will be inserted until new data is ready to be output. 
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11.2.3 Serial Wire Output format 
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The TPIU can output trace data in a Serial Wire Output (SWO) format: 
e TPIU_DEVID specifies the formats that are supported. See TPIU_DEVID on page 11-12. 


e TPIU_SPPR specifies the SWO format in use. See the ARMv7-M Architecture Reference 
Manual. 


When one of the two SWO modes is selected, you can enable the TPIU to bypass the formatter 
for trace output. If the formatter is bypassed, only the ITM and DWT trace source passes 
through. The TPIU accepts and discards data from the ETM. This function can be used to 
connect a device containing an ETM to a trace capture device that is only able to capture SWO 
data. 
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TPIU programmers model 
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Table 11-1 provides asummary of the TPIU registers. Depending on the implementation of your 
processor, the TPIU registers might not be present, or the CoreSight TPIU might be present 
instead. Any register that is configured as not present reads as zero. 


Table 11-1 TPIU registers 



















































































Address Name Type Reset Description 

0xE0040000 TPIU SSPSR RO QxOxx Supported Parallel Port Size Register 

0xE0040004 TPIU CSPSR RW 0x01 Current Parallel Port Size Register 

0xE0040010 TPIU ACPR RW 0x0000 Asynchronous Clock Prescaler Register, TPIU_ACPR on page 11-6 
0xE00400F0 TPIU SPPR RW 0x01 Selected Pin Protocol Register 

0xE0040300 TPIU FFSR RO 0x08 Formatter and Flush Status Register, TPIU_FFSR on page 11-6 
QxE0040304 TPIU FFCR RW 0x102 Formatter and Flush Control Register, TPIU_FFCR on page 11-7 
0xE0040308 TPIU FSCR RO 0x00 Formatter Synchronization Counter Register 

0xE0040EE8 TRIGGER RO 0x0 TRIGGER on page 11-8 

0xE0040EEC FIFO data 0 RO 0x--000000 Integration FIFO 0 Data on page 11-8 

0xE0040EF0  ITATBCTR2 RO 0x0 ITATBCTR2 on page 11-9 

0xE0040EFC FIFO data 1 RO Qx--000000 Integration FIFO 1 Data on page 11-10 

0xE0040EF8 ITATBCTRO RO 0x0 ITATBCTRO on page 11-11 

0xE0040F00  ITCTRL RW 0x0 Integration Mode Control, TPIU_ITCTRL on page 11-11 
Q@xEQ040FAQ = CLAIMSET RW QxF Claim tag set 

Q@xEQ040FA4 CLAIMCLR RW 0x0 Claim tag clear 

0xE0040FC8 DEVID RO - TPIU_DEVID on page 11-12 

0xE0040FDO PID4 RO 0x04 Peripheral identification registers 

0xE0040FD4 PIDS RO 0x00 

0xE0040FD8  PID6 RO 0x00 

0xE0040FDC PID7 RO 0x00 

0xE0040FEO PIDO RO QxAl1 

QxEQQ40FE4 PIDI RO QxB9 

0xE0040FE8 PID2 RO 0x0B 

OxE0040FEC = PID3 RO 0x00 

0xE0040FF0 CIDO RO 0x0D Component identification registers 

0xE0040FF4 CIDI RO 0x90 

0xE0040FF8 CID2 RO 0x05 

QxEQQ40FFC CID3 RO 0xB1 
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The following sections describe the TPIU registers whose implementation is specific to this 
processor. The Formatter, Integration Mode Control, and Claim Tag registers are described in 
the CoreSight Components Technical Reference Manual. Other registers are described in the 
ARMv7-M Architecture Reference Manual. 


11.3.1 Asynchronous Clock Prescaler Register, TPIU_ACPR 


The TPIU_ACPR characteristics are: 

Purpose Scales the baud rate of the asynchronous output. 

Usage constraints There are no usage constraints. 

Configurations This register is available in all processor configurations. 
Attributes See Table 11-1 on page 11-5. 


Figure 11-2 shows the TPIU_ACPR bit assignments. 
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Figure 11-2 TPIU_ACPR bit assignments 


Table 11-2 shows the TPIU_ACPR bit assignments. 
Table 11-2 TPIU_ACPR bit assignments 


Bits Name Function 


[31:13] - Reserved. RAZ/SBZP. 





[12:0] PRESCALER Divisor for TRACECLKIN is Prescaler + 1. 


11.3.2 Formatter and Flush Status Register, TPIU_FFSR 
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The TPIU_FFSR characteristics are: 

Purpose Indicates the status of the TPIU formatter. 

Usage constraints There are no usage constraints. 

Configurations This register is available in all processor configurations. 
Attributes See Table 11-1 on page 11-5. 


Figure 11-3 shows the TPIU_FFSR bit assignments. 
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Figure 11-3 TPIU_FFSR bit assignments 
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Table 11-3 TPIU_FFSR bit assignments 


Bits Name 


[31:4] - 


Function 


Reserved 





[3] FtNonStop 


Formatter cannot be stopped 





[2] TCPresent 


This bit always reads zero 





[1] FtStopped 


This bit always reads zero 





[0] FlInProg 


11.3.3 Formatter and Flush Control Register, TPIU_FFCR 
The TPIU_FFCR characteristics are: 
Purpose Controls the TPIU formatter. 


Usage constraints There are no usage constraints. 


This bit always reads zero 


Configurations This register is available in all processor configurations. 


Attributes See Table 11-1 on page 11-5. 


Figure 11-4 shows the TPIU_FFCR bit assignments. 
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Figure 11-4 TPIU_FFCR bit assignments 


Table 11-4 shows the TPIU_FFCR bit assignments. 


Table 11-4 TPIU_FFCR bit assignments 











Bits Name Function 

[31:9] - Reserved. 

[8] TrigIn This bit Reads-As-One (RAO), specifying that triggers are inserted when a trigger pin is asserted. 
[7:2] - Reserved. 

[1] EnFCont Enable continuous formatting. Value can be: 


0 = Continuous formatting disabled. 
1 = Continuous formatting enabled. 





[0] - Reserved. 


The TPIU can output trace data in a Serial Wire Output (SWO) format. See Serial Wire Output 


format on page 11-4. 
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When one of the two SWO modes is selected, bit [1] of TPIU_FFCR enables the formatter to 
be bypassed. If the formatter is bypassed, only the ITM and DWT trace source passes through. 
The TPIU accepts and discards data from the ETM. This function is can be used to connect a 
device containing an ETM to a trace capture device that is only able to capture SWO data. 
Enabling or disabling the formatter causes momentary data corruption. 


Note ———____- 


If TPIU_SPPR is set to select Parallel Port Mode, the formatter is automatically enabled. If you 
then select one of the SWO modes, TPIU_FFCR reverts to its previously programmed value. 





11.3.4 TRIGGER 
The TRIGGER characteristics are: 
Purpose Integration test of the TRIGGER input. 
Usage constraints There are no usage constraints. 
Configurations This register is available in all processor configurations. 
Attributes See Table 11-1 on page 11-5. 


Figure 11-5 shows the TRIGGER bit assignments. 


31 y ! | | 10 


e O 


TRIGGER input value _ 


Figure 11-5 TRIGGER bit assignments 
Table 11-5 shows the TRIGGER bit assignments. 


Table 11-5 TRIGGER bit assignments 





Bits Name Function 
[31:1] - Reserved 
[0] TRIGGER input value When read, this bit returns the TRIGGER input. 


11.3.5 Integration FIFO 0 Data 
The Integration FIFO 0 Data characteristics are: 
Purpose Trace data integration testing. 


Usage constraints You must set bit [1] of TPIU_ITCTRL to use this register. See Integration 
Mode Control, TPIU_ITCTRL on page 11-11. 


Configurations This register is available in all processor configurations. 
Attributes See Table 11-1 on page 11-5 


Figure 11-6 on page 11-9 shows the Integration FIFO 0 Data bit assignments. 
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Figure 11-6 Integration FIFO 0 Data bit assignments 


Table 11-6 shows the Integration FIFO 0 Data bit assignments. 


Table 11-6 Integration FIFO 0 bit assignments 

















Bits Name Function 

[31:30] - Reserved 

[29] FIFO 1 ATVALID input Returns the value of the ATVALID2 signal. 

[28:27] FIFO 1 byte count Number of bytes of FIFO 1 trace data since last read of Integration ITM Data Register. 

[26] FIFO 0 ATVALID input Returns the value of the ATVALID1 signal. 

[25:24] FIFO 0 byte count Number of bytes of FIFO 0 trace data since last read of Integration ETM Data Register. 
[23:16] FIFO 0 data 2 These fields contain ETM data if the ETM is present. If the ETM is not present, these fields 





contain ITM data. The TPIU discards this data when the register is read. 
[15:8] FIFO 0 data 1 





[7:0] FIFO 0 data 0 


11.3.6 ITATBCTR2 
The ITATBCTR2 characteristics are: 
Purpose Integration test. 


Usage constraints You must set bit [0] of TPIU_ITCTRL to use this register. See Integration 
Mode Control, TPIU_ITCTRL on page 11-11. 


Configurations This register is available in all processor configurations. 
Attributes See Table 11-1 on page 11-5. 


Figure 11-7 shows the ITATBCTR2 bit assignments. 
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Figure 11-7 ITATBCTR2 bit assignments 
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Table 11-7 shows the ITATBCTR2 bit assignments. 


Table 11-7 ITATBCTR2 bit assignments 


Bits Name Function 


Reserved 





[0] ATREADY1, ATREADY2 This bit sets the value of both the ETM and ITM ATREADY 


11.3.7 Integration FIFO 1 Data 


outputs, if the TPIU is in integration test mode. 


The Integration FIFO 1 Data characteristics are: 


Purpose 


Trace data integration testing. 


Usage constraints You must set bit [1] of TPIU ITCTRL to use this register. See Integration 


Mode Control, TPIU_ITCTRL on page 11-11. 


Configurations This register is available in all processor configurations. 


Attributes 


See Table 11-1 on page 11-5 


Figure 11-8 shows the Integration FIFO 1 Data bit assignments. 
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Figure 11-8 Integration FIFO 1 Data bit assignments 


Table 11-8 shows the Integration FIFO 1 Data bit assignments. 


Table 11-8 Integration FIFO 1 Data bit assignments 























Bits Name Function 

[31:30]  - Reserved 

[29] FIFO 1 ATVALID input Returns the value of the FIFO 1 ATVALID signal. 

[28:27] FIFO 1 byte count Number of bytes of FIFO 1 trace data since last read of Integration ITM Data Register. 

[26] FIFO 0 ATVALID input Returns the value of the FIFO 0 ATVALID| signal. 

[25:24] FIFO 0 byte count Number of bytes of FIFO 0 trace data since last read of Integration ETM Data Register. 

[23:16] FIFO 1 data 2 These fields contain ITM trace data if an ETM is present. The TPIU discards this data 
when the register is read. 

[15:8] FIFO 1 data 1 

[7:0] FIFO 1 data 0 
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Trace Port Interface Unit 


The ITATBCTRO characteristics are: 

Purpose Integration test. 

Usage constraints There are no usage constraints. 

Configurations This register is available in all processor configurations. 
Attributes See Table 11-1 on page 11-5. 


Figure 11-9 shows the ITATBCTRO bit assignments. 
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Figure 11-9 ITATBCTRO bit assignments 


Table 11-9 shows the ITATBCTRO bit assignments. 
Table 11-9 ITATBCTRO bit assignments 
Bits Name Function 


[31:1] - Reserved 





[0] ATVALID1, ATVALID2 A read of this bit returns the value of ATVALIDS1 OR-ed with 
ATVALIDS2. 


11.3.9 Integration Mode Control, TPIU_ITCTRL 


ARM DDI 0337H 
ID032710 


The TPIU_ITCTRL characteristics are: 

Purpose Specifies normal or integration mode for the TPIU. 
Usage constraints There are no usage constraints. 

Configurations This register is available in all processor configurations. 
Attributes See Table 11-1 on page 11-5. 


Figure 11-10 shows the TPIU_ITCTRL bit assignments. 
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Figure 11-10 TPIU_ITCTRL bit assignments 
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Trace Port Interface Unit 


Table 11-10 shows the TPIU_ITCTRL bit assignments. 
Table 11-10 TPIU_ITCTRL bit assignments 


Bits Name Function 





[31:2] - Reserved. 

[1:0] Mode Specifies the current mode for the TPIU: 
b00 normal mode 
b01 integration test mode 
b10 integration data test mode 
b11 Reserved. 


In integration data test mode, the trace output is disabled, and data can be read 
directly from each input port using the integration data registers. 


The TPIU_DEVID characteristics are: 


Purpose Indicates the functions provided by the TPIU for use in topology 
detection. 


Usage constraints There are no usage constraints. 
Configurations This register is available in all processor configurations. 
Attributes See Table 11-1 on page 11-5. 


Figure 11-11 shows the TPIU_DEVID bit assignments. 
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Figure 11-11 TPIU_DEVID bit assignments 
Table 11-11 shows the TPIU_DEVID bit assignments. 


Table 11-11 TPIU_DEVID bit assignments 
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Bits Name Function 

[31:12] - Reserved 

[11] Asynchronous Serial Wire This bit Reads-As-One (RAO), indicating that the output is 
Output (NRZ) supported. 

[10] Asynchronous Serial Wire This bit Reads-As-One (RAO), indicating that the output is 
Output (Manchester) supported. 

[9] Parallel trace port mode This bit Reads-As-Zero (RAZ), indicating that parallel trace port 


mode is supported. 
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Table 11-11 TPIU_DEVID bit assignments (continued) 


Bits Name Function 


[8:6] Minimum buffer size Specifies the minimum TPIU buffer size: 
b010 = 4 bytes 








[S] Asynchronous Specifies whether TRACECLKIN can be asynchronous to CLK: 
TRACECLKIN bl = TRACECLKIN can be asynchronous to CLK. 
[4:0] Number of trace inputs Specifies the number of trace inputs: 


b000000 = 1 input 
b000001 = 2 inputs 


If your implementation includes an ETM, the value of this field is 
b000001. 
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Appendix A 
Revisions 


This appendix describes the technical changes between released issues of this book. 


Change 


Introductory processor information updated 


Table A-1 Differences between issue E and issue F 


Location 


Issue H distributes this information between About the processor 
on page 1-2 and Features on page 1-3 and removes duplicate 
information from these sections. 





Processor block diagram updated 


Figure 2-1 on page 2-2 





Introductory information added, including: 

° TPIU subsection 

. Addition of note to SW/SWJ-DP subsection 
° ROM table subsection. 





Introductory processor core information updated 


Issue H removes this information. 





APB bus now version 3.0 


Architecture and protocol information on page 1-7 





Configurable options information expanded to include: 
. Added DWT configurability information 


° New subsections for ITM, AHB-AP, FPB and Observation. 


Configurable options on page 1-5 





New subsection added to list changes in functionality between 
rlp1 and r2p0 


Differences in functionality between rlpI and r2p0 on page 1-10 





Information about the programmers model updated 
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Issue H distributes this information between Operating modes on 
page 3-3 and Operating states on page 3-3. 
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Table A-1 Differences between issue E and issue F (continued) 


Change 


Definition of ICI field of Execution Program Status Register 
updated 


Location 


Issue H removes this information. 





Table of nonsupported Thumb instructions removed. 





Second footnote on Table 5-1 removed. 





Addition of note to vector table and reset description 





Description of SLEEPING and SLEEPDEEP signals updated. 





Description of extending sleep functionality added 


Issue H removes this information. 





Addition of Auxiliary Control Register 


Auxiliary Control Register, ACTLR on page 4-5 





Irq 0 to 31 Priority Register amended to Irq 0 to 3 Priority 
Register 





Irq 236 to 239 Priority Register amended to Irq 224 to 239 
Priority Register 





HCLK changed to FCLK 


Issue H removes this information. 





Addition of ascending MPU region priority information 


About the MPU on page 5-2 





Extra paragraph added. 





Debug Core Register Selector Register REGSEL bit field 
function updated 





Paragraph added about removing FPB 


Issue H removes this information. 





Addition of note about configuring flash patch registers to be 
present or not 


FPB programmers model on page 7-10 





First bullet point updated 


About the DWT on page 8-2 





Addition of note about configuring DWT registers to be present 
or not 


DWT Programmers Model on page 8-4 





DWT Control Register reset state updated 


Table 8-1 on page 8-4 





DWT Control Register bit assignments updated 


Issue H removes this information. 





Addition of note about configuring ITM registers to be present or 
not 





ITM Trace Control Register TSENA field bit function updated 


ITM programmers model on page 9-4 





Addition of note about configuring AHB-AP registers to be 
present or not 


AHB-AP programmers model on page 7-6 





AHB-AP Banked Data Register DATA field reset value removed 


Issue H removes this information. 





Addition of information about absence of debug functionality 


About debug on page 7-2 





Information about exclusive memory accesses updated 


Issue H removes this information. 





Note about bit-band accesses updated 


Bit-banding on page 3-16 





ETM block diagram updated 
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Figure 10-1 on page 10-3 
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Revisions 


Table A-1 Differences between issue E and issue F (continued) 


Change Location 


HCLK and CLK replaced by FCLK Issue H removes this information. 





ETM Trigger Even Register description upgraded 





ETM Status Register description updated 





TraceEnable register replaced by Trace Start/Stop Resource 
Control 





TraceEnable Control 2 register added 





Lock Status Register added 





Description of FIFOFULL Region Register added 





Description of FIFOFULL Level Register updated 





Description of CoreSight Trace ID Register updated 





Description ETM Control Register implementation bits expanded Main Control Register, ETMCR on page 10-10 

















Description of TraceEnable Control 1 Register updated TraceEnable Control 1 Register ETMTECRI on page 10-15 
Description ETM ID Register updated to reflect revision 2 ID Register, ETMIDR on page 10-16 

Subsection describing ETM Event Resources added Resources on page 10-3 

Subsection describing Cross Trigger Interface added Recommended CTI connections on page 10-7 

Branch status interface section updated Issue H removes this information. 





Note about HADDRICore and HTRANSICore removed 





Example of an opcode sequence timing diagram updated 





Description of APB interface inputs added 





Addition of note about configuring TPIU registers to be present TPIU programmers model on page 11-5 
or not 





The following TPIU registers removed from summary table and Issue H removes this information. 
descriptions: 


° Trigger control registers 
° EXTCTL port registers 
è Test pattern registers. 





The following TPIU registers added to the summary table and 


descriptions: 
. Integration Register: TRIGGER 
° Integration Mode Control Register 


° Integration Register: FIFO data 0 
° Integration Register: FIFO data 1 


° Claim tag set register 
° Claim tag clear register 
. Device ID register 


° PID registers 
. CID registers. 
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Table A-2 Differences between issue F and issue G 


Change Location 


Wake-up Interrupt Controller (WIC) added to Cortex-M3 block Figure 2-1 on page 2-2 
diagram 





Section 1-2 and section 1-3 combined Issue H distributes this information between Features on 
page 1-3, Interfaces on page 1-4, and Configurable options on 
page 1-5. 





New subsection added to list changes in functionality between Differences in functionality between rlpI and r2p0 on page 1-10 
rlp1 and r2p0 





New subsection added to describe the WIC Low power modes on page 6-3 





New bullet point to describe FIXHMASTERTYPE pin Differences in functionality between rlpI and r2p0 on page 1-10 





Table of supported instruction removed Issue H reinstates this information in Table 3-1 on page 3-4. 





More information added about the stacked xPSR Issue H removes this information. 





Reset value of Configuration Control Register changed to 
0x00000200 





System and Vendor_SYS memory regions added to table of 
memory region permissions 





Memory region for Private Peripheral Bus changed to +0000000 





SLEEPHOLDREQ changed to SEEEPHOLDREQn 





SLEEPHOLDACK changed to SEEEPHOLDACKn 





DEEPSLEEP signal changed to SLEEPDEEP 





DBGRESTARTACK changed to DBGRESTARTED 





DBGRESTARTREO changed to DBGRESTART 





New subsection added to describe the WIC 





Address of Irq 224 to 239 Priority Register changed to 0xE000E4EC 





Enhanced description of function of C_MASKINTS field 





Settings for DWT Function Registers updated 





Minor change to timing information of ETMIA 
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Table A-2 Differences between issue F and issue G (continued) 


Change Location 


Change to timing information for ETMIVALID Issue H removes this information. 





SLEEPHOLDREOn removed from table of miscellaneous input 
ports timing parameters 





Table of low power input ports timing parameters added 





FIXHMASTERTYPE added to table of debug input ports timing 
parameters 





Input changed to Output in table header 





SLEEPING, SLEEPDEEP, and SLEEPHOLDACKn removed 
from table of miscellaneous output ports timing parameters 





SLEEPDEEP, SLEEPING, SLEEPHOLDREO, and 
SLEEPHOLDACK removed 





New section added to describe the low power interface signals 





New section added to describe the WIC interface signals 





SLEEPHOLDACKn removed from table of miscellaneous 
signals 





Asserted changed to de-asserted in the description of 
SLEEPHOLDREQn in table of low power interface signals 





FIXMASTERTPYE added to list of AHB-AP interface signals 





Note 


Issue H of this book is significantly reorganized and simplified to eliminate duplication of 
information contained in the ARM Architecture Reference Manual and other ARM 
documentation. 


Table A-3 Differences between issue G and issue H 


Change Location 


Chapter 1 simplified to provide only a high-level description of Chapter 1 Introduction 








the processor. Some information to Chapter 2. Chapter 2 Functional Description 

Removed the following sections from Chapter 1: See the ARMv7-M Architecture Reference Manual 
. Execution pipeline stages and the implementation documentation for the 

° Prefetch unit Pao 

° Branch target forwarding 

° Store buffers. 

Added functional description chapter Chapter 2 Functional Description 





Simplified description of the programmers model and modes of About the programmers model on page 3-2 





operation and execution Modes of operation and execution on page 3-3 
Added cycle counts to instruction set summary Instruction set summary on page 3-4 
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Revisions 


Table A-3 Differences between issue G and issue H (continued) 


Change 


Descriptions of the memory system and of exceptions moved to 
Chapter 3. 


Location 


Chapter 3 Programmers Model 





Component-specific registers moved from System Control 
chapter to appropriate chapters within the manual. 


Chapter 4 System Control 





Deleted Clocking and Resets chapter. 





Deleted Power Management chapter. 





In the Memory Protection Unit and Nested Vector Interrupt 
Controller chapters, removed description of 
architecturally-defined registers. 


See the implementation documentation for the 
processor. 





Reorganized debug description into a single chapter. 


Chapter 7 Debug 





Deleted Bus Interface chapter and moved high-level information 
to appropriate chapters. 


Chapter 1 Introduction 
Chapter 2 Functional Description 
Chapter 3 Programmers Model 





Deleted Debug Port chapter and incorporated general information 
from this chapter into chapters 2 and 7. 


Chapter 2 Functional Description 
Chapter 7 Debug 





Moved information from the System Debug chapter to create new 
chapters for the Data Watchpoint and Trace Unit and the 
Instrumentation Trace Macrocell Unit. 


Chapter 8 Data Watchpoint and Trace Unit 


Chapter 9 Instrumentation Trace Macrocell Unit 





Reorganized Embedded Trace Macrocell description into a single 
chapter. 


Chapter 10 Embedded Trace Macrocell 





Removed signal information and architecturally-defined register 
descriptions from the Trace Port Interface Unit chapter. 


Removed duplicate information. See the ARMv7-M 
Architecture Reference Manual and the 
implementation documentation for the processor. 





Moved instruction timing information to chapter 3. 


Instruction set summary on page 3-4 





Removed AC Characteristics and Signal Descriptions chapters. 


Non-Confidential 


See the implementation documentation for the 
processor. 
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Glossary 


This glossary describes some of the terms used in technical documents from ARM. 


Abort A mechanism that indicates to a core that the attempted memory access 1s invalid or not allowed or 
that the data returned by the memory access is invalid. An abort can be caused by the external or 
internal memory system as a result of attempting to access invalid or protected instruction or data 
memory. 


See also Data Abort, External Abort and Prefetch Abort. 


Addressing modes Various mechanisms, shared by many different instructions, for generating values used by the 
instructions. 


Advanced High-performance Bus (AHB) 
A bus protocol with a fixed pipeline between address/control and data phases. It only supports a 
subset of the functionality provided by the AMBA AXI protocol. The full AMBA AHB protocol 
specification includes a number of features that are not commonly required for master and slave IP 
developments and ARM recommends only a subset of the protocol is usually used. This subset is 
defined as the AMBA AHB-Lite protocol. 


See also Advanced Microcontroller Bus Architecture and AHB-Lite. 


Advanced Microcontroller Bus Architecture (AMBA) 
A family of protocol specifications that describe a strategy for the interconnect. AMBA is the ARM 
open standard for on-chip buses. It is an on-chip bus specification that details a strategy for the 
interconnection and management of functional blocks that make up a System-on-Chip (SoC). It aids 
in the development of embedded processors with one or more CPUs or signal processors and 
multiple peripherals. AMBA complements a reusable design methodology by defining a common 
backbone for SoC modules. 
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Advanced Peripheral Bus (APB) 


AHB 


A simpler bus protocol than AXI and AHB. It is designed for use with ancillary or 
general-purpose peripherals such as timers, interrupt controllers, UARTs, and I/O ports. 
Connection to the main system bus is through a system-to-peripheral bus bridge that helps to 
reduce system power consumption. 


See Advanced High-performance Bus. 


AHB Access Port (AHB-AP) 


AHB-AP 


AHB-Lite 


AHB Trace Macrocell 


Aligned 


AMBA 


An optional component of the DAP that provides an AHB interface to a SoC. 
See AHB Access Port. 


A subset of the full AMBA AHB protocol specification. It provides all of the basic functions 
required by the majority of AMBA AHB slave and master designs, particularly when used with 
a multi-layer AMBA interconnect. In most cases, the extra facilities provided by a full AMBA 
AHB interface are implemented more efficiently by using an AMBA AXI protocol interface. 


A hardware macrocell that, when connected to a processor core, outputs data trace information 
on a trace port. 


A data item stored at an address that is divisible by the number of bytes that defines the data size 
is said to be aligned. Aligned words and halfwords have addresses that are divisible by four and 
two respectively. The terms word-aligned and halfword-aligned therefore stipulate addresses 
that are divisible by four and two respectively. 


See Advanced Microcontroller Bus Architecture. 


Advanced Trace Bus (ATB) 


APB 


A bus used by trace devices to share CoreSight capture resources. 


See Advanced Peripheral Bus. 


Application Specific Integrated Circuit (ASIC) 


Architecture 


ARM instruction 


ARM state 


ASIC 
ATB 
ATB bridge 
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An integrated circuit that has been designed to perform a specific application function. It can be 
custom-built or mass-produced. 


The organization of hardware and/or software that characterizes a processor and its attached 
components, and enables devices with similar characteristics to be grouped together when 
describing their behavior, for example, Harvard architecture, instruction set architecture, 
ARMv/7-M architecture. 


An instruction of the ARM Instruction Set Architecture (ISA). These cannot be executed by the 
Cortex-M3 processor. 


The processor state in which the processor executes the instructions of the ARM ISA. The 
processor only operates in Thumb state, never in ARM state. 


See Application Specific Integrated Circuit. 
See Advanced Trace Bus. 


A synchronous ATB bridge provides a register slice to facilitate timing closure through the 
addition of a pipeline stage. It also provides a unidirectional link between two synchronous ATB 
domains. 


An asynchronous ATB bridge provides a unidirectional link between two ATB domains with 
asynchronous clocks. It is intended to support connection of components with ATB ports 
residing in different clock domains. 
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Base register 


Base register write-back 


Beat 


BE-8 


BE-32 


Big-endian 


Big-endian memory 


Boundary scan chain 


Branch folding 


Breakpoint 


Burst 
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A register specified by a load or store instruction that is used to hold the base value for the 
instruction’s address calculation. Depending on the instruction and its addressing mode, an 
offset can be added to or subtracted from the base register value to form the address that is sent 
to memory. 


Updating the contents of the base register used in an instruction target address calculation so that 
the modified address is changed to the next higher or lower sequential address in memory. This 
means that it is not necessary to fetch the target address for successive instruction transfers and 
enables faster burst accesses to sequential memory. 


Alternative word for an individual data transfer within a burst. For example, an INCR4 burst 
comprises four beats. 


Big-endian view of memory in a byte-invariant system. 
See also BE-32, LE, Byte-invariant and Word-invariant. 
Big-endian view of memory in a word-invariant system. 
See also BE-8, LE, Byte-invariant and Word-invariant. 


Byte ordering scheme in which bytes of decreasing significance in a data word are stored at 
increasing addresses in memory. 


See also Little-endian and Endianness. 
Memory in which: 


° a byte or halfword at a word-aligned address is the most significant byte or halfword 
within the word at that address 


° a byte at a halfword-aligned address is the most significant byte within the halfword at that 
address. 


See also Little-endian memory. 


A boundary scan chain is made up of serially-connected devices that implement boundary scan 
technology using a standard JTAG TAP interface. Each device contains at least one TAP 
controller containing shift registers that form the chain connected between TDI and TDO, 
through which test data is shifted. Processors can contain several shift registers to enable you to 
access Selected parts of the device. 


Branch folding is a technique where the branch instruction is completely removed from the 
instruction stream presented to the execution pipeline. 


A breakpoint is a mechanism provided by debuggers to identify an instruction at which program 
execution is to be halted. Breakpoints are inserted by the programmer to enable inspection of 
register contents, memory locations, variable values at fixed points in the program execution to 
test that the program is operating correctly. Breakpoints are removed after the program is 
successfully tested. 


See also Watchpoint. 


A group of transfers to consecutive addresses. Because the addresses are consecutive, there is 
no requirement to supply an address for any of the transfers after the first one. This increases the 
speed at which the group of transfers can occur. Bursts over AMBA are controlled using signals 
to indicate the length of the burst and how the addresses are incremented. 


See also Beat. 
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Byte An 8-bit data item. 


Byte-invariant In a byte-invariant system, the address of each byte of memory remains unchanged when 
switching between little-endian and big-endian operation. When a data item larger than a byte 
is loaded from or stored to memory, the bytes making up that data item are arranged into the 
correct order depending on the endianness of the memory access. The ARM architecture 
supports byte-invariant systems in ARMv6 and later versions. When byte-invariant support is 
selected, unaligned halfword and word memory accesses are also supported. Multi-word 
accesses are expected to be word-aligned. 


See also Word-invariant. 


Clock gating Gating a clock signal for a macrocell with a control signal and using the modified clock that 
results to control the operating state of the macrocell. 


Clocks Per Instruction (CPI) 
See Cycles Per Instruction (CPI). 


Cold reset Also known as power-on reset. 
See also Warm reset. 
Context The environment that each process operates in for a multitasking operating system. 


See also Fast context switch. 


Core A core 1s that part of a processor that contains the ALU, the datapath, the general-purpose 
registers, the Program Counter, and the instruction decode and control circuitry. 

Core reset See Warm reset. 

CoreSight The infrastructure for monitoring, tracing, and debugging a complete system on chip. 

CPI See Cycles per instruction. 


Cycles Per instruction (CPI) 
Cycles per instruction (or clocks per instruction) is a measure of the number of computer 
instructions that can be performed in one clock cycle. This figure of merit can be used to 
compare the performance of different CPUs that implement the same instruction set against each 
other. The lower the value, the better the performance. 


Data Abort An indication from a memory system to the core of an attempt to access an illegal data memory 
location. An exception must be taken if the processor attempts to use the data that caused the 
abort. 


See also Abort. 
DCode Memory Memory space at 0x00000000 to Ox1FFFFFFFF. 


Debug Access Port (DAP) 
A TAP block that acts as an AMBA, AHB or AHB-Lite, master for access to a system bus. The 
DAP is the term used to encompass a set of modular blocks that support system wide debug. The 
DAP is a modular component, intended to be extendable to support optional access to multiple 
systems such as memory mapped AHB and CoreSight APB through a single debug interface. 


Debugger A debugging system that includes a program, used to detect, locate, and correct software faults, 
together with custom hardware that supports software debugging. 


Embedded Trace Buffer 
The ETB provides on-chip storage of trace data using a configurable sized RAM. 
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Embedded Trace Macrocell (ETM) 


Endianness 


ETB 
ETM 


Exception 


Exception handler 


Exception vector 


External PPB 


A hardware macrocell that, when connected to a processor core, outputs instruction trace 
information on a trace port. 


Byte ordering. The scheme that determines the order that successive bytes of a data word are 
stored in memory. An aspect of the system’s memory mapping. 


See also Little-endian and Big-endian 
See Embedded Trace Buffer. 
See Embedded Trace Macrocell. 


An error or event which can cause the processor to suspend the currently executing instruction 
stream and execute a specific exception handler or interrupt service routine. The exception could 
be an external interrupt or NMI, or it could be a fault or error event that is considered serious 
enough to require that program execution is interrupted. Examples include attempting to 
perform an invalid memory access, external interrupts, and undefined instructions. When an 
exception occurs, normal program flow is interrupted and execution is resumed at the 
corresponding exception vector. This contains the first instruction of the interrupt service 
routine to deal with the exception. 


See Interrupt service routine. 
See Interrupt vector. 


PPB memory space at 0xE0040000 to @xEQQFFFFF. 


Flash Patch and Breakpoint unit (FPB) 


Formatter 


Halfword 


Halt mode 


Host 


HTM 
¡Code Memory 
Illegal instruction 


Implementation-defined 


Implementation-specific 
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A set of address matching tags, that reroute accesses into flash to a special part of SRAM. This 
permits patching flash locations for breakpointing and quick fixes or changes. 


The formatter is an internal input block in the ETB and TPIU that embeds the trace source ID 
within the data to create a single trace stream. 


A 16-bit data item. 


One of two mutually exclusive debug modes. In halt mode all processor execution halts when a 
breakpoint or watchpoint is encountered. All processor state, coprocessor state, memory and 
input/output locations can be examined and altered by the JTAG interface. 


See also Monitor debug-mode. 


A computer that provides data and other services to another computer. Especially, a computer 
providing debugging services to a target being debugged. 


See AHB Trace Macrocell. 
Memory space at 0x00000000 to Ox1FFFFFFF. 


An instruction that is architecturally Undefined. 


The behavior is not architecturally defined, but is defined and documented by individual 
implementations. 


The behavior is not architecturally defined, and does not have to be documented by individual 
implementations. Used when there are a number of implementation options available and the 
option chosen does not affect software compatibility. 
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Instruction cycle count 


Instrumentation trace 


Glossary 


The number of cycles for which an instruction occupies the Execute stage of the pipeline. 


A component for debugging real-time systems through a simple memory-mapped trace 
interface, providing printf style debugging. 


Intelligent Energy Management (IEM) 


Internal PPB 


Interrupt service 
routine 


Interrupt vector 


A technology that enables dynamic voltage scaling and clock frequency variation to be used to 
reduce power consumption in a device. 


PPB memory space at 0xE0000000 to 0xE003FFFF. 


A program that control of the processor 1s passed to when an interrupt occurs. 


One of a number of fixed addresses in low memory that contains the first instruction of the 
corresponding interrupt service routine. 


Joint Test Action Group (JTAG) 


JTAG 


The name of the organization that developed standard IEEE 1149.1. This standard defines a 
boundary-scan architecture used for in-circuit testing of integrated circuit devices. It is 
commonly known by the initials JTAG. 


See Joint Test Action Group. 


JTAG Debug Port (JTAG-DP) 


JTAG-DP 
LE 


Little-endian 


Little-endian memory 


Load/store architecture 


Load Store Unit (LSU) 


LSU 


Macrocell 
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An optional external interface for the DAP that provides a standard JTAG interface for debug 
access. 


See JTAG Debug Port. 


Little-endian view of memory in both byte-invariant and word-invariant systems. See also 
Byte-invariant, Word-invariant. 


Byte ordering scheme in which bytes of increasing significance in a data word are stored at 
increasing addresses in memory. 


See also Big-endian and Endianness. 


Memory in which: 


° a byte or halfword at a word-aligned address is the least significant byte or halfword 
within the word at that address 


. a byte at a halfword-aligned address is the least significant byte within the halfword at that 
address. 


See also Big-endian memory. 


A processor architecture where data-processing operations only operate on register contents, not 
directly on memory contents. 


The part of a processor that handles load and store transfers. 
See Load Store Unit. 


A complex logic block with a defined interface and behavior. A typical VLSI system comprises 
several macrocells (such as a processor, an ETM, and a memory block) plus application-specific 
logic. 
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Memory coherency A memory is coherent 1f the value read by a data read or instruction fetch is the value that was 
most recently written to that location. Memory coherency 1s made difficult when there are 
multiple possible physical locations that are involved, such as a system that has main memory, 
a write buffer and a cache. 


Memory Protection Unit (MPU) 
Hardware that controls access permissions to blocks of memory. Unlike an MMU, an MPU does 
not modify addresses. 


Microprocessor See Processor. 


Monitor debug-mode 
One of two mutually exclusive debug modes. In Monitor debug-mode the processor enables a 
software abort handler provided by the debug monitor or operating system debug task. When a 
breakpoint or watchpoint is encountered, this enables vital system interrupts to continue to be 
serviced while normal program execution is suspended. 


See also Halt mode. 
MPU See Memory Protection Unit. 


Multi-layer An interconnect scheme similar to a cross-bar switch. Each master on the interconnect has a 
direct link to each slave, The link is not shared with other masters. This enables each master to 
process transfers in parallel with other masters. Contention only occurs in a multi-layer 
interconnect at a payload destination, typically the slave. 


Nested Vectored Interrupt Controller (NVIC) 
Provides the processor with configurable interrupt handling abilities. 


NMI See Non-maskable interrupt 


Non-maskable interrupt 
A NonMaskable Interrupt (NMJ) can be signalled by a peripheral or triggered by software. This 
is the highest priority exception other than reset. It is permanently enabled and has a fixed 
priority of -2. NMIs cannot be: 


° masked or prevented from activation by any other exception 
° preempted by any exception other than Reset. 
NVIC See Nested Vectored Interrupt Controller. 
Penalty The number of cycles in which no useful Execute stage pipeline activity can occur because an 


instruction flow is different from that assumed or predicted. 
PFU See Prefetch Unit. 
PMU See Power Management Unit. 


Power Management Unit (PMU) 
Provides the processor with power management capability. 


Power-on reset See Cold reset. 
PPB See Private Peripheral Bus. 
Prefetching In pipelined processors, the process of fetching instructions from memory to fill up the pipeline 


before the preceding instructions have finished executing. Prefetching an instruction does not 
mean that the instruction has to be executed. 
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Prefetch Abort 


Prefetch Unit (PFU) 


Private Peripheral Bus 


Processor 


RW1C 


RealView ICE 


Reserved 


Scan chain 


Serial-Wire Debug Port 


Serial-Wire JTAG 
Debug Port 


SW-DP 
SWJ-DP 


Synchronization primitive 


System memory 
TAP 


Test Access Port (TAP) 
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An indication from a memory system to the core that an instruction has been fetched from an 
illegal memory location. An exception must be taken if the processor attempts to execute the 
instruction. A Prefetch Abort can be caused by the external or internal memory system as a 
result of attempting to access invalid instruction memory. 


See also Data Abort, Abort. 


The PFU fetches instructions from the memory system that can supply one word each cycle. The 
PFU buffers up to three word fetches in its FIFO, which means that it can buffer up to three 
32-bit Thumb instructions or six 16-bit Thumb instructions. 


Memory space at 0xE0000000 to OxEQOFFFFF. 


A processor is the circuitry in a computer system required to process data using the computer 
instructions. It is an abbreviation of microprocessor. A clock source, power supplies, and main 
memory are also required to create a minimum complete working computer system. 


Register bits marked RWIC can be read normally and support write-one-to-clear. A read then 
write of the result back to the register will clear all bits set. RW1C protects against 
read-modify-write errors occurring on bits set between reading the register and writing the value 
back (since they are written as zero, they will not be cleared). 


A system for debugging embedded processor cores using a JTAG interface. 


A field in a control register or instruction format is reserved if the field is to be defined by the 
implementation, or produces Unpredictable results if the contents of the field are not zero. These 
fields are reserved for use in future extensions of the architecture or are 
implementation-specific. All reserved bits not used by the implementation must be written as 0 
and read as 0. 


A scan chain is made up of serially-connected devices that implement boundary scan technology 
using a standard JTAG TAP interface. Each device contains at least one TAP controller 
containing shift registers that form the chain connected between TDI and TDO, through which 
test data is shifted. Processors can contain several shift registers to enable you to access selected 
parts of the device. 


An optional external interface for the DAP that provides a serial-wire bidirectional debug 
interface. 


A standard debug port that combines JTAG-DP and SW-DP. 


See Serial-Wire Debug Port. 
See Serial-Wire JTAG Debug Port. 


The memory synchronization primitive instructions are those instructions that are used to ensure 
memory synchronization. That is, the LDREX and STREX instructions. 


Memory space at 0x20000000 to OxFFFFFFFF, excluding PPB space at 0xE0000000 to OxEQQFFFFF. 


See Test access port. 


The collection of four mandatory and one optional terminals that form the input/output and 
control interface to a JTAG boundary-scan architecture. The mandatory terminals are TDI, 
TDO, TMS, and TCK. The optional terminal is TRST. This signal is mandatory in ARM cores 
because it is used to reset the debug logic. 
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Thread Control Block A data structure used by an operating system kernel to maintain information specific to a single 
thread of execution. 


Thumb instruction A halfword that specifies an operation for an ARM processor in Thumb state to perform. Thumb 
instructions must be halfword-aligned. 


Thumb state A processor that is executing Thumb (16-bit) halfword aligned instructions is operating in 
Thumb state. 


TPA See Trace Port Analyzer. 
TPIU See Trace Port Interface Unit. 


Trace Port Analyzer (TPA) 
A hardware device that captures trace information output on a trace port. This can be a low-cost 
product designed specifically for trace acquisition, or a logic analyzer. 


Trace Port Interface Unit (TPIU) 
Drains trace data and acts as a bridge between the on-chip trace data and the data stream 


captured by a TPA. 
Unaligned A data item stored at an address that is not divisible by the number of bytes that defines the data 
size 1s said to be unaligned. For example, a word stored at an address that is not divisible by four. 
Wake-up Interrupt The Wake-up Interrupt Controller provides significantly reduced gate count interrupt detection 
Controller (WIC) and prioritization logic. 
Warm reset Also known as a core reset. Initializes the majority of the processor excluding the debug 


controller and debug logic. This type of reset is useful if you are using the debugging features 
of a processor. 


Watchpoint A watchpoint is a mechanism provided by debuggers to halt program execution when the data 
contained by a particular memory address is changed. Watchpoints are inserted by the 
programmer to enable inspection of register contents, memory locations, and variable values 
when memory is written to test that the program is operating correctly. Watchpoints are removed 
after the program is successfully tested. See also Breakpoint. 


WIC See Wake-up Interrupt Controller. 
Word A 32-bit data item. 
Word-invariant In a word-invariant system, the address of each byte of memory changes when switching 


between little-endian and big-endian operation, in such a way that the byte with address A in 
one endianness has address A EOR 3 in the other endianness. As a result, each aligned word of 
memory always consists of the same four bytes of memory in the same order, regardless of 
endianness. The change of endianness occurs because of the change to the byte addresses, not 
because the bytes are rearranged. 


The ARM architecture supports word-invariant systems in ARMv3 and later versions. When 
word-invariant support is selected, the behavior of load or store instructions that are given 
unaligned addresses is instruction-specific, and is in general not the expected behavior for an 
unaligned access. It is recommended that word-invariant systems use the endianness that 
produces the required byte addresses at all times, apart possibly from very early in their reset 
handlers before they have set up the endianness, and that this early part of the reset handler must 
use only aligned word memory accesses. 


See also Byte-invariant. 


Write buffer A pipeline stage for buffering write data to prevent bus stalls from stalling the processor. 
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